Edit tour

Windows Analysis Report
442.docx.exe

Overview

General Information

Sample name:	442.docx.exe renamed because original name is a hash value
Original sample name:	.docx.exe
Analysis ID:	1567328
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
Infos:

Detection

RMSRemoteAdmin

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

442.docx.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\442.docx.exe" MD5: FB8117B1A3F0924100FBC209DBBB1BB1)

msiexec.exe (PID: 7584 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

WINWORD.EXE (PID: 7656 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

msiexec.exe (PID: 7620 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7736 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3A7D5E944AD6C6FD24895B2767E40451 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 1900 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi" MD5: CB9BE257064162076EBD4869CD97E166)

rutserv.exe (PID: 2200 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7512 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rutserv.exe (PID: 7212 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

svchost.exe (PID: 7888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rutserv.exe (PID: 7796 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

rfusclient.exe (PID: 8092 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 7540 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

rfusclient.exe (PID: 8140 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: CB9BE257064162076EBD4869CD97E166)

rutserv.exe (PID: 6104 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: D563A4D6BFCFE6884D1AC88824CB5C2A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39e594:$s1: rman_message 0x46d594:$s3: rms_host_ 0x46df4c:$s3: rms_host_ 0x82acb0:$s4: rman_av_capture_settings 0x877858:$s5: rman_registry_key 0x8778a4:$s5: rman_registry_key 0x543d6c:$s6: rms_system_information 0x2f1a18:$s7: _rms_log.txt 0x503238:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.3573808248.000000000314A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000002.3573808248.0000000003118000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000011.00000002.3572801729.00000000017DA000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000002.3579027400.0000000004B64000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000011.00000002.3572801729.00000000017B6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000002.3579027400.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 1900	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 2200	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7796	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.rfusclient.exe.310000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
9.0.rfusclient.exe.310000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a1d58:$s1: rman_message 0x453340:$s3: rms_host_ 0x453cf8:$s3: rms_host_ 0x816eb4:$s4: rman_av_capture_settings 0x45a4c4:$s7: _rms_log.txt 0x4bf3c8:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\442.docx.exe", CommandLine: "C:\Users\user\Desktop\442.docx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\442.docx.exe, NewProcessName: C:\Users\user\Desktop\442.docx.exe, OriginalFileName: C:\Users\user\Desktop\442.docx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\442.docx.exe", ProcessId: 7480, ProcessName: 442.docx.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.90.147.125, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Initiated: true, ProcessId: 7796, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49870

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7888, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Remote Admin Backdoor Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T12:48:20.628368+0100	2849354	1	Malware Command and Control Activity Detected	192.168.2.4	49873	111.90.147.125	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD245A0 rmsEncInitSimpleEncryption,memcpy,memcpy,	9_2_5FD245A0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD23760 rmsEncEncryptData,	9_2_5FD23760
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD23D30 rmsEncRsaPrivateDecrypt,memcpy,memcpy,memcpy,	9_2_5FD23D30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD242D0 rmsEncRsaPrivateEncrypt,memcpy,memcpy,memcpy,	9_2_5FD242D0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD238C0 rmsEncDecryptData,	9_2_5FD238C0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD23AE0 rmsEncRsaPublicEncrypt,memcpy,	9_2_5FD23AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FD24000 rmsEncRsaPublicDecrypt,memcpy,memcpy,memcpy,	9_2_5FD24000

Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_09749e9a-1

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 9.2.rfusclient.exe.310000.0.unpack

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 442.docx.exe, 00000000.00000000.1710698957.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmp, 442.docx.exe, 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7ED6B40BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7ED6CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6DFCA0 FindFirstFileExA,	0_2_00007FF7ED6DFCA0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	9_2_600E6B90
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then sub esp, 1Ch	9_2_600EBEB0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 4x nop then push esi	9_2_600E6AD0

Source: winword.exe

Memory has grown: Private usage: 4MB later: 92MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2849354 - Severity 1 - ETPRO MALWARE Remote Admin Backdoor Related Activity : 192.168.2.4:49873 -> 111.90.147.125:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 111.90.147.125 ports 5651,465,4,5,6,55555,80

Source: global traffic	TCP traffic: 192.168.2.4:49806 -> 95.213.205.83:5655
Source: global traffic	TCP traffic: 192.168.2.4:49809 -> 109.234.156.179:5655
Source: global traffic	TCP traffic: 192.168.2.4:49871 -> 111.90.147.125:5651
Source: global traffic	TCP traffic: 192.168.2.4:49874 -> 78.138.9.142:5651

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 78.138.9.142
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 109.234.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.147.125

Source: global traffic

DNS traffic detected: DNS query: id72.internetid.ru

Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024C8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlB)
Source: rutserv.exe, 00000010.00000003.2572074671.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2095413447.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlF.
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlP)
Source: rutserv.exe, 00000010.00000003.1960578808.0000000002566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlu
Source: rutserv.exe, 00000010.00000003.2572074671.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2095413447.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: rutserv.exe, 00000010.00000003.2572074671.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2095413447.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl:UV
Source: rutserv.exe, 00000010.00000003.2572074671.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2095413447.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crlXW
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: svchost.exe, 00000005.00000002.3419566312.000001C99D400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024C8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D6D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: rfusclient.exe, 00000009.00000000.1816392501.000000000035F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1929061008.000000007B5F0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1939132075.000000007CAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024C8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3603820083.00000000044F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/
Source: rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/R
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45
Source: rutserv.exe, 00000010.00000003.1960578808.0000000002566000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6N
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr456)
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr458.0
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45T.
Source: rutserv.exe, 00000010.00000003.1960914551.0000000002556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45Z.
Source: rutserv.exe, 00000010.00000003.1960578808.0000000002566000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965487513.0000000002568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45zF
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020
Source: rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965487513.0000000002577000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965487513.000000000256F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020P)
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020T.
Source: rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020Z.
Source: rutserv.exe, 00000010.00000002.3577310653.0000000002561000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2572074671.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2095413447.0000000002559000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965746877.0000000002559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020http://crl.globalsign.com/gsgccr45codesignca2020.cr
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: rutserv.exe, 00000010.00000002.3574164629.0000000002498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr31.3.6.1.5.5.7.48.2http://secure.globalsign.com/cacert/root-r3.crtE
Source: rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr3http://crl.globalsign.com/root-r3.crlk
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru///rmansys.ru/;
Source: rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000002.3604652724.000000000482F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/nsys.ru/pf
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/pf
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/rd
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/web-help/eb-help/D
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: svchost.exe, 00000005.00000003.3118282077.000001C9980B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3419150789.000001C9980B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.dm
Source: rfusclient.exe, 00000009.00000000.1816392501.000000000035F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1929061008.000000007B5F0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1939132075.000000007CAC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade.ini
Source: rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade_beta.ini
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 00000009.00000003.1836674180.0000000003005000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000009.00000000.1816392501.0000000000B6B000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000001221000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000A.00000003.1880620859.0000000003F75000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000C.00000003.1911028682.0000000003F85000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000F.00000003.1939737722.0000000003F05000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: rfusclient.exe, 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D73F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D6E3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D728000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D747000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: rutserv.exe, 0000000A.00000002.1895252133.000000006028F000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugsrg/bugs/):
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000005.00000003.1765637227.000001C99D696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/
Source: rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/O
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/about/privacy-policy.php
Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/buy/money-back-guarantee.php
Source: rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/installing-and-uninstalling/

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.0.rfusclient.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6AC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7ED6AC2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\440b40.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF85.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10DE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\440b43.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\440b43.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIF85.tmp

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6CCE88	0_2_00007FF7ED6CCE88
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6A5E24	0_2_00007FF7ED6A5E24
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C1F20	0_2_00007FF7ED6C1F20
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6AF930	0_2_00007FF7ED6AF930
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B4928	0_2_00007FF7ED6B4928
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D0754	0_2_00007FF7ED6D0754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6CB190	0_2_00007FF7ED6CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C3484	0_2_00007FF7ED6C3484
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BA4AC	0_2_00007FF7ED6BA4AC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C2D58	0_2_00007FF7ED6C2D58
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C8DF4	0_2_00007FF7ED6C8DF4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D0754	0_2_00007FF7ED6D0754
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6E2080	0_2_00007FF7ED6E2080
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BAF18	0_2_00007FF7ED6BAF18
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6DFA94	0_2_00007FF7ED6DFA94
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B1A48	0_2_00007FF7ED6B1A48
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6E5AF8	0_2_00007FF7ED6E5AF8
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C2AB0	0_2_00007FF7ED6C2AB0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6A1AA4	0_2_00007FF7ED6A1AA4
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BC96C	0_2_00007FF7ED6BC96C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C3964	0_2_00007FF7ED6C3964
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D89A0	0_2_00007FF7ED6D89A0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D8C1C	0_2_00007FF7ED6D8C1C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BBB90	0_2_00007FF7ED6BBB90
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B5B60	0_2_00007FF7ED6B5B60
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C4B98	0_2_00007FF7ED6C4B98
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6A76C0	0_2_00007FF7ED6A76C0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6E2550	0_2_00007FF7ED6E2550
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BB534	0_2_00007FF7ED6BB534
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6A4840	0_2_00007FF7ED6A4840
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6DC838	0_2_00007FF7ED6DC838
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6A7288	0_2_00007FF7ED6A7288
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B126C	0_2_00007FF7ED6B126C
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6AA310	0_2_00007FF7ED6AA310
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6AC2F0	0_2_00007FF7ED6AC2F0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6BF180	0_2_00007FF7ED6BF180
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C21D0	0_2_00007FF7ED6C21D0
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6C53F0	0_2_00007FF7ED6C53F0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600CDC00	9_2_600CDC00
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600D5800	9_2_600D5800
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600CD620	9_2_600CD620
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_6018E260	9_2_6018E260
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_60167080	9_2_60167080
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600D5AE0	9_2_600D5AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_5FDD6850	9_2_5FDD6850
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600CCBD0	9_2_600CCBD0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 17_2_0076B9AC	17_2_0076B9AC

Source: unires_vpd.dll.2.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: rutserv.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.2.dr	Static PE information: Resource name: MAD type: DOS executable (COM, 0x8C-variant)
Source: rfusclient.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unidrvui_rppd.dll0.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unires_vpd.dll0.2.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: libasset32.dll.2.dr	Static PE information: Number of sections : 19 > 10
Source: rutserv.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: libcodec32.dll.2.dr	Static PE information: Number of sections : 20 > 10

Source: unires_vpd.dll0.2.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll.2.dr	Static PE information: No import functions for PE file found

Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB730000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB6C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 442.docx.exe
Source: 442.docx.exe, 00000000.00000003.1722235136.000001E8BB5E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 442.docx.exe

Source: 9.0.rfusclient.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll0.2.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll.2.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal92.troj.evad.winEXE@27/327@1/5

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6AB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7ED6AB6D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6C8624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF7ED6C8624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$898
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1d74
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1e74
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1c2c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$1e74
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$17d8
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1fcc
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f9c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1d58
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1fcc
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$76c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f9c

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFC37BCDF51AD3764F.TMP

Jump to behavior

Source: 442.docx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rfusclient.exe	String found in binary or memory: ENGINESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3"
Source: rfusclient.exe	String found in binary or memory: MODULESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules"
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3

Source: C:\Users\user\Desktop\442.docx.exe

File read: C:\Users\user\Desktop\442.docx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\442.docx.exe "C:\Users\user\Desktop\442.docx.exe"
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3A7D5E944AD6C6FD24895B2767E40451
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3A7D5E944AD6C6FD24895B2767E40451	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll

Source: C:\Users\user\Desktop\442.docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Doc.LNK.3.dr

LNK file: ..\..\..\..\..\..\..\intel\Doc.docx

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: 442.docx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 442.docx.exe

Static file information: File size 25141051 > 1048576

Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 442.docx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 442.docx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 442.docx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 442.docx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 9.2.rfusclient.exe.310000.0.unpack

Source: C:\Users\user\Desktop\442.docx.exe

File created: C:\intel\__tmp_rar_sfx_access_check_4457687

Jump to behavior

Source: 442.docx.exe	Static PE information: section name: .didat
Source: 442.docx.exe	Static PE information: section name: _RDATA
Source: vp8encoder.dll.2.dr	Static PE information: section name: .rodata
Source: vp8decoder.dll.2.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.2.dr	Static PE information: section name: _RDATA
Source: libasset32.dll.2.dr	Static PE information: section name: /4
Source: libasset32.dll.2.dr	Static PE information: section name: /14
Source: libasset32.dll.2.dr	Static PE information: section name: /29
Source: libasset32.dll.2.dr	Static PE information: section name: /41
Source: libasset32.dll.2.dr	Static PE information: section name: /55
Source: libasset32.dll.2.dr	Static PE information: section name: /67
Source: libasset32.dll.2.dr	Static PE information: section name: /78
Source: libasset32.dll.2.dr	Static PE information: section name: /94
Source: libasset32.dll.2.dr	Static PE information: section name: /110
Source: libcodec32.dll.2.dr	Static PE information: section name: .rodata
Source: libcodec32.dll.2.dr	Static PE information: section name: /4
Source: libcodec32.dll.2.dr	Static PE information: section name: /14
Source: libcodec32.dll.2.dr	Static PE information: section name: /29
Source: libcodec32.dll.2.dr	Static PE information: section name: /41
Source: libcodec32.dll.2.dr	Static PE information: section name: /55
Source: libcodec32.dll.2.dr	Static PE information: section name: /67
Source: libcodec32.dll.2.dr	Static PE information: section name: /78
Source: libcodec32.dll.2.dr	Static PE information: section name: /94
Source: libcodec32.dll.2.dr	Static PE information: section name: /110
Source: eventmsg.dll.2.dr	Static PE information: section name: .didata
Source: webmvorbisencoder.dll.2.dr	Static PE information: section name: _RDATA
Source: vccorlib120.dll.2.dr	Static PE information: section name: minATL
Source: rutserv.exe.2.dr	Static PE information: section name: .didata
Source: rfusclient.exe.2.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.2.dr	Static PE information: section name: minATL

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6E5166 push rsi; retf	0_2_00007FF7ED6E5167
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6E5156 push rsi; retf	0_2_00007FF7ED6E5157
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 9_2_600E7E30 push eax; mov dword ptr [esp], esi	9_2_600E7ED1
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Code function: 16_2_00D2C34B push ebx; ret	16_2_00D2C354

Source: msvcr120.dll.2.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: VPDAgent.exe.2.dr	Static PE information: section name: .text entropy: 6.812931691200469

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.exe

Static PE information: 442.docx.exe

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer Security

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 0000000A.00000000.1843751400.0000000001221000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000F.00000002.1951137481.0000000002238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 0000000F.00000002.1951137481.0000000002238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE
Source: rutserv.exe, 0000000A.00000002.1885182179.00000000022E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEI
Source: rutserv.exe, 0000000F.00000002.1951137481.0000000002238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE<
Source: rutserv.exe, 0000000A.00000002.1885182179.00000000022E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEA
Source: rutserv.exe, 0000000A.00000002.1885182179.00000000022E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEW

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Window / User API: threadDelayed 6337

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_9-6556

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

API coverage: 5.8 %

Source: C:\Windows\System32\svchost.exe TID: 7916	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2132	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 7992	Thread sleep time: -50000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8124	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8112	Thread sleep count: 6337 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8112	Thread sleep time: -63370s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8072	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 6740	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8124	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6B40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7ED6B40BC
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7ED6CB190
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6DFCA0 FindFirstFileExA,	0_2_00007FF7ED6DFCA0

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6D16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF7ED6D16A4

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 50000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000

Source: svchost.exe, 00000005.00000002.3418863473.000001C99802B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: svchost.exe, 00000005.00000002.3419675889.000001C99D457000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3574164629.00000000024C8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1965487513.0000000002577000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.2094884831.0000000002577000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1960578808.0000000002566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rfusclient.exe, 00000009.00000002.1838575078.000000000145D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6D76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7ED6D76D8

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6E0D20 GetProcessHeap,

0_2_00007FF7ED6E0D20

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

Jump to behavior

Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7ED6D76D8
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7ED6D3170
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7ED6D2510
Source: C:\Users\user\Desktop\442.docx.exe	Code function: 0_2_00007FF7ED6D3354 SetUnhandledExceptionFilter,	0_2_00007FF7ED6D3354

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6CB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7ED6CB190

Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\442.docx.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior

Source: rfusclient.exe, 00000009.00000000.1816392501.000000000035F000.00000020.00000001.01000000.0000000B.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6BDC70 cpuid

0_2_00007FF7ED6BDC70

Source: C:\Users\user\Desktop\442.docx.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF7ED6CA2CC

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6D0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7ED6D0754

Source: C:\Users\user\Desktop\442.docx.exe

Code function: 0_2_00007FF7ED6B4EB0 GetVersionExW,

0_2_00007FF7ED6B4EB0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rutserv.exe, 0000000A.00000000.1843751400.0000000001221000.00000020.00000001.01000000.0000000D.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 0000000F.00000002.1951137481.0000000002238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Blob

Jump to behavior

Source: Yara match	File source: 9.0.rfusclient.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3573808248.000000000314A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3573808248.0000000003118000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3572801729.00000000017DA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3579027400.0000000004B64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3572801729.00000000017B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3579027400.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 1900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	13 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	67 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	121 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	4%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	8%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	13%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	12%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSIF85.tmp	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	0%	ReversingLabs
C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://rmansys.ru/rd	0%	Avira URL Cloud	safe
http://rmansys.ru/web-help/eb-help/D	0%	Avira URL Cloud	safe
http://schemas.dm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
main.internetid.ru	95.213.205.83	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.208.103	true	false	high
id72.internetid.ru	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru///rmansys.ru/	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	rfusclient.exe, 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://update.tektonit.ru/upgrade.ini	rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://update.tektonit.ru/upgrade_beta.ini	rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://madExcept.comU	rfusclient.exe, 00000009.00000000.1816392501.000000000035F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1929061008.000000007B5F0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1939132075.000000007CAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	rfusclient.exe, 00000009.00000000.1816392501.000000000035F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000000821000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1929061008.000000007B5F0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000003.1939132075.000000007CAC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/rd	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru/web-help/eb-help/	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000005.00000002.3419566312.000001C99D400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000005.00000003.1765637227.000001C99D6E3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D728000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D747000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1765637227.000001C99D734000.00000004.00000800.00020000.00000000.sdmp	false		high
http://rmansys.ru/pf	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	rfusclient.exe, 00000009.00000003.1836674180.0000000003005000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000009.00000000.1816392501.0000000000B6B000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1843751400.0000000001221000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 0000000A.00000003.1880620859.0000000003F75000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000C.00000003.1911028682.0000000003F85000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 0000000F.00000003.1939737722.0000000003F05000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://www.symauth.com/cps0(	442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/internet-id/	rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000002.3604652724.000000000482F000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/web-help/eb-help/D	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	rutserv.exe, 0000000A.00000002.1895252133.0000000060277000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000005.00000003.1765637227.000001C99D73F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugsrg/bugs/):	rutserv.exe, 0000000A.00000002.1895252133.000000006028F000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://www.symauth.com/rpa00	442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/	rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
https://rmansys.ru/remote-access/	rutserv.exe, 00000010.00000002.3578675457.0000000002A6E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/nsys.ru/pf	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.flexerasoftware.com0	442.docx.exe, 00000000.00000003.1722235136.000001E8BB661000.00000004.00000020.00020000.00000000.sdmp, 442.docx.exe, 00000000.00000003.1722235136.000001E8BB623000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	442.docx.exe, 00000000.00000003.1722235136.000001E8BB591000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000005.00000003.1765637227.000001C99D702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/buy/money-back-guarantee.php	rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/about/privacy-policy.php	rfusclient.exe, 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.dm	svchost.exe, 00000005.00000003.3118282077.000001C9980B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3419150789.000001C9980B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmansys.ru///rmansys.ru/;	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rmansys.ru/web-help/	rutserv.exe, 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.234.156.179	unknown	Russian Federation	49505	SELECTELRU	false
111.90.147.125	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
78.138.9.142	unknown	United Kingdom	8513	SKYVISIONGB	false
95.213.205.83	main.internetid.ru	Russian Federation	50340	SELECTEL-MSKRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567328
Start date and time:	2024-12-03 12:46:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	442.docx.exe renamed because original name is a hash value
Original Sample Name:	.docx.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@27/327@1/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 23.218.208.109, 52.109.89.19, 84.201.208.103, 52.111.252.17, 52.111.252.15, 52.111.252.16, 52.111.252.18, 52.182.143.208, 95.101.110.60, 95.101.110.34, 95.101.110.24, 95.101.110.31, 95.101.110.27, 23.32.238.192, 23.32.238.169, 104.18.21.226, 104.18.20.226
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, cdn.globalsigncdn.com.cdn.cloudflare.net, templatesmetadata.office.net.edgekey.net, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ocsp.globalsign.com, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, onedscolprdcus04.centralus.cloudapp.azure.com, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod-all.naturallanguageeditorservice.osi.office.net.akadns.net, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, prod-inc-resolver.naturallanguageeditorservice.osi.office.net.akadns.n
Execution Graph export aborted for target rutserv.exe, PID 2200 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 442.docx.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.213.205.83	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
main.internetid.ru	https://bitbucket.org/ziphose/obmen/downloads/Doc.7z	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
	ExeFile (206).exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	winserv.exe	Get hash	malicious	RMSRemoteAdmin, xRAT	Browse	95.213.205.83
	3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	84.201.208.99
	SPP_14667098030794_8611971920#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	84.201.208.101
	rAttached_updat.vbs	Get hash	malicious	GuLoader, Remcos	Browse	84.201.211.40
	1d5sraR1S1.exe	Get hash	malicious	AgentTesla	Browse	84.201.211.39
	file.exe	Get hash	malicious	Stealc	Browse	217.20.56.100
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	217.20.56.102
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	84.201.208.106
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	217.20.56.101
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	84.201.208.102
	Demande de proposition du Regional Development Network .pdf	Get hash	malicious	Unknown	Browse	84.201.208.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYVISIONGB	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	83.229.59.112
	https://www.google.ml/url?fvg=1YI3fC8whlGPBCiMyiuQ&bhtBf=8EQhXbuMThqowIo0zyCX&sa=t&ndg=afydNw3nDHf9A6uq2MCH&url=amp%2Fiestpcanipaco.edu.pe%2F.r%2Fu1kOgE-SURELILYYWRhcnNoLm1hbGhvdHJhQGphdG8uY29t	Get hash	malicious	HTMLPhisher	Browse	78.138.9.37
	arm4.elf	Get hash	malicious	Mirai	Browse	217.194.146.92
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	217.194.158.58
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	83.229.19.82
	https://bread.nfpt.adfixagency.co.in/	Get hash	malicious	Unknown	Browse	78.138.9.37
	https://bread1.nfpt.adfixagency.co.in/landingv2	Get hash	malicious	Unknown	Browse	78.138.9.37
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	101.99.75.104
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	111.90.149.151
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	111.90.141.53
	Ssc Executed Docs#962297(Revised).docx	Get hash	malicious	Unknown	Browse	111.90.146.230
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	101.99.125.192
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	124.217.225.17
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
SELECTELRU	nabppc.elf	Get hash	malicious	Unknown	Browse	85.119.147.53
	6X4BIzTTBR.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.37
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.37
	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.177
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	176.113.115.203
	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	176.113.115.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	https://bitbucket.org/ziphose/obmen/downloads/Doc.7z	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse

Created / dropped Files

C:\Config.Msi\440b42.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	33259
Entropy (8bit):	5.289166899208134
Encrypted:	false
SSDEEP:	768:n5t4t4t+ZXTWBwp1KwUXciM01HuECHgCg4gcgblFljY3TY3s8:qCBwpswUXceHuECHgCg4gcgblFlE3U3j
MD5:	22641644251074FE8A4B2152864D3A5A
SHA1:	5D06BEE490179007C4E4E626080AC3E5E3747FCF
SHA-256:	E061FEF209F79109F2B24C96C3517946F1EFCD24252678AAB6A00EB2442F16E1
SHA-512:	D1F495B16EE2E775F39985EB4FBA4AFEC8D4094339D6EF2B13353CF5151A97436280835A80F6FC3D241782E6FC94064A9B7D0B0D2E01D291987FF2A1C1EB185C
Malicious:	false
Preview:	...@IXOS.@.....@.5.Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.].....ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2...&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}&.{77817ADF-D5EC-49C6-B987-6169BBD5345B}.@......&.{3244CD

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	140524
Entropy (8bit):	4.705761523836363
Encrypted:	false
SSDEEP:	768:wu3K4JDvJNJt2cGTXxl5loUWDTEhkClEgoKt9ai1IYdO5NVSUeDfydxqXJe2JNC0:wu93dN2OqrYZlKhIiSEGQ4wL
MD5:	65B04B706AC06E31210F4FFB1E92994E
SHA1:	B005637B3DE903CBD7960637D77FF993897C5A63
SHA-256:	E9ACC22A02BC2148AE07EC7CBE741E6E1CBC90DE3856AAE8F32A31FB5C338566
SHA-512:	5B708D069434A384738EFD5F4621F257FC79A7F5A32D8AE9C1D29E21EFE1EEB2C393EC67DA39714C0C73F2217B68091EE7196C72331838A0A7ECA872FAF09A09
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0204

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.579534230870796
Encrypted:	false
SSDEEP:	192:XxgSABvdm4Yy3EA39QKoEp0Fm7qFAmL8x2fLWwsU7K6CYv7+C:Xx0FmW3Ea1KmexmMK6jr
MD5:	C2F009D6317D1BA4E722938A1408478A
SHA1:	66D702BC9FA98D1E7FE9BBC16AFF9AE711019E9B
SHA-256:	6A8D4FB6F90B53D986B2AC6BF3BFCC56D6A54A2E8AF5670129566F5D344ED0FA
SHA-512:	4D8060EC77EB9B95B57BC20AF2685064FA1E1FCC9403EFE95572C37D72ACD39B8005831EA0BAE95C365E945E50962B7FE1BFD964C5776D3E99CE5E474F726BFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: J4zGPhVRV3.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: 044f.pdf.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......J....@.................................."..x....@..................@....P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2673984
Entropy (8bit):	6.865614554810881
Encrypted:	false
SSDEEP:	49152:BE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeF8:BE8XHX5riUl7wDP6vQ/qpyr0kR5XLWDB
MD5:	10CD2135C0C5D9D3E5A0A5B679F2FAAE
SHA1:	A0617D8C6876F98B9A1819A71F2A56B965C1C75D
SHA-256:	D7A97387505CA740AC88E85CAC3AA3CA73C666CC3BFD977C7E40B1D9D6CA6C12
SHA-512:	6A1F81127FF26DCC235D7CE454E69F9A3784AC54BBC8486CB5022AAC47C2FB6003641A0F8AAFDD3B89812FE3C1C90569AD73C1C135687C042CE92C5DD2FFBDD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L...h3.\............................5u............@.......................... ).......(...@.................................<.&.......'.H.............(.@.....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1110848
Entropy (8bit):	6.491478844569486
Encrypted:	false
SSDEEP:	24576:TqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzb:tQSX0oAtkpf/bfcyTTmoozb
MD5:	AB3E77FC94445A18C9376F98CE10102F
SHA1:	9424736FB3DB517C5584A14A482F84D81A671F8D
SHA-256:	EEE325D9AC6A7B24B8ED3742110BD042803D6DA065F2E51153151E69D51CE4A3
SHA-512:	454115C621434E98D39AEC605FCEB349C7AFB938B3E822F5950EE60E54FBFCB5CDBFE750015FE947C07FB991B4E966E535640343294D885ED2661353D3FD6EC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d.......................@........l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.464002114523214
Encrypted:	false
SSDEEP:	384:2+b57Gk7g+iy21oCiDuK9jkrtpgjKMpFmexmMK6j8qF2:7/210DuVrtsKM3ZxBKghF2
MD5:	2DE35EAAE57A6BAA02D9E8ED0661F042
SHA1:	82D14A58D5188F5B7606365BE0E3F968A8E81E93
SHA-256:	BB43036D202D3DBD765A12D1C4C243E7AB8328FFC1941AEA838D8B1553700E64
SHA-512:	02F1D530C1469431A94074A057FCE3FE60735D3B15DD767E8F39F29B702B98B061954063D83D5FA426D7684CC86359E87424F0CC54FFB0AC3F388AA7E48D6DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L...k3.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:..@....p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4005696
Entropy (8bit):	6.809616089473951
Encrypted:	false
SSDEEP:	98304:lbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FAK:FR+lDOt5kgFvVwmd
MD5:	2C5987EA1E87A5C073B780F8102AE09C
SHA1:	78DAA99D8C59A4A2E0D3B59E5427F854D8613080
SHA-256:	22AC34380064C0FFEE59AD892CA4695E94EE8F97B78C18565251295817A784FE
SHA-512:	7D6432960C5F3BEC27B13D06D4126C91A1DD7DD702DE97F1001855D8572BE68D6526F419BB58F5E5238E8E8F81C801BDAD8F351EF0AE75564835146F3DD3434D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.....3.=...@.........................pA:......p:.d.....;...............=.@.....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39744
Entropy (8bit):	6.36744082696392
Encrypted:	false
SSDEEP:	384:TkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQzUQ9LSk3E0gTSsn2TkhI3K0Jn:TLqokSaddQzUNk3EXSsn2Tk4ZZxBKgfP
MD5:	9ED8BAA9DEC76C6AFAFC1C71193A0AE8
SHA1:	843727F195BF194CFF3736B80FB5249713F1E116
SHA-256:	CD2C60402D46C339147ADDF110C904F78A783F23106CCAD147EFA156175D66DE
SHA-512:	40D85540176AB0170B7341D6A8A808FD351B35C6444D468E7707B35D2B2E8F3322DBF0BF31E0578E3A12E1A62B310DD7983B7EFB0F2C72D0C4104AEB0BBCEFF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L....3.\.................D...8.......I.......`....@.......................................@..................................s.......................\|..@............b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179520
Entropy (8bit):	5.239011393842513
Encrypted:	false
SSDEEP:	1536:+vQrKBVxKfGkHM5ZZ+HHJOWfuXO8zIJ1k9XHX8t0wk7UAjKQpmErUaDO3nG:3kjiTGD+JOWGT00XHXo0w+mErBO3G
MD5:	FF197487BFE7E9D3396E0793B83811ED
SHA1:	D92CA066B79DF28BF22BB051AEDFE10E4FA4A2A6
SHA-256:	E6D0CA844514FDD105772E72C7C30D47099112AB68A4A5F9E4A2B28C0372A05A
SHA-512:	33A13B0EE7E3DD038B35B5E4220278016397D003DCEECA56C3EE264608E053940AAFC09AE582C0FD67DFA919F38265883269F6C1A93E5BB9047B97F4A51CACCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L....3.\.................\..........8........p....@..........................0......T.....@.................................,5.......`..V...............@....... ....z..8...........................(...@............0..,............................text....[.......\.................. ..`.rdata...D...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53056
Entropy (8bit):	6.556803642202102
Encrypted:	false
SSDEEP:	768:AqfYixknAt1kJSwlxeZQHPFtuEK+XLxSzELK4ZHZxBKgCu:8ixknqaxxeZ09tVr7xkyZ5ncu
MD5:	A7A19BFD82EEAE7D4DC00144F3B949F4
SHA1:	FBD6EF10A7D519386CB32B093AE7E42852BAECBD
SHA-256:	A32A93B71A5628EDFC19FD31D26AC60DAF364E89CFDA2C82071718814042BE55
SHA-512:	5AC0F6A0FDAAB8B832B0021948101ABD1C8AF8B79E0C02D60770DF22D945D669AE7D588BD3264F9991E11CBAB01A445AAC9B594B47171C68A6A7BDC3FBB8D962
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L...j3.\.................v...:......Ez............@.................................Ul....@.................................t...x.......@...............@...............8..............................@...............\|............................text....u.......v.................. ..`.rdata... ......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772288
Entropy (8bit):	6.917291195041145
Encrypted:	false
SSDEEP:	49152:UuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChRebU:UuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpj
MD5:	9FD469846E628F44A4147743875FFBC0
SHA1:	6065C496D7C2695F3678D945FFA3FEFFBCD83C53
SHA-256:	129C2D91F085E54FD9E333C6F580A16907A1D9659D823D6C7CB25F5D3CE55CC8
SHA-512:	5AF5DD95BE604E039337D153CED2B9D3FE33F2E05818E3A222FDD9F7B3381197CCF3CA39324F46CA95B81DF76624F0EF4A0CF045195640E58B9A233D092F43AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... ....................................N....@.........................p.'..:..T.(.......)...............*.@.....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2991424
Entropy (8bit):	6.7900679594310915
Encrypted:	false
SSDEEP:	49152:kz1BQT/9rrcXgJoHt3LhNSTuHo6E7hVNO8B/3LUvQ/qpyr0kRZTKjEKMUP9isAxI:kz1BI5U3lNS6Ho6E7vBRIvQ/qpyr0kuF
MD5:	829DD10CD377386A2040897F5288DDB0
SHA1:	A7B1C7A6C0E1C9641750E8150EE810530FB67DD0
SHA-256:	5753F66DBC480901955DE247117F3C1E99777B1A610C90931E50C374F8B1D888
SHA-512:	C6B915EBF7B1C023FBB2E06FB169857539253CFA2B5B5C770DF5A43896AF8A0C847796E3F82C6109778F11D7FE3976DA172E1E0E6EACCD1C82DBAEB80ADAB4F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L....3.\..................!...........!......."...@...........................-.....;.....@...........................+.+.....+.......,.@.............-.@.....,..C...................................w+.@............."..............................text...g.!.......!................. ..`.rdata..$.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35648
Entropy (8bit):	6.365966080243848
Encrypted:	false
SSDEEP:	768:nE2YHORRn1SNBaiAL3X8jARHb2Os7fAK6ncZxBKg1xDo:E862HbPs7otEnzNo
MD5:	68EA0EC529B7B9D3284D860F5ABD9BB4
SHA1:	1A3951538D9E79F09792C8B118F010834A6C1273
SHA-256:	EE963C5960F6687789004175C3DF0098331BEBBCE992BF9C73EF9EF6ED73C1E0
SHA-512:	E62D2CFCA2433F4D647A5658141D63093D75491C60D1647F41FFDE74308BDF1A512DEBCC4A4535CE6FC9DE1ACB149D135D89366FE75FC9C52AA709C8887D7A28
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d....4.\.........." .....V..........\|P....................................................@..........................................d..W....[..................`....l..@........... ................................................................................text...'U.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204096
Entropy (8bit):	5.820956822859452
Encrypted:	false
SSDEEP:	3072:co2/UxSJBXgK5IsZsYMNV7jWCQQD9KdtvB1WOAahmRF:co284/XgGfbuYAKdf1WOAaO
MD5:	126C2BCC9112266CE33F9835A1E44B9C
SHA1:	B16C0D19797C7A0CC665BC8346ECF453234A83A4
SHA-256:	2736C2919966D17F27A34D69A7253CD4C2D09C6F7CF9FC03597F27BC73C0BDC2
SHA-512:	C25FC46CA2D8DAAD868FA2B5F1BA6CCAAC7F919C8C7CBB86952741B493D27E79EC8C7FD5F124A704B78F4197E6F3812D0FE0F64BC00117EE2AC09B41FAE85308
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d....4.\.........." .................~....................................................`..........................................G..l...\H..........(.......<.......@...............................................p............................................text...-........................... ..`.rdata..Z...........................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102208
Entropy (8bit):	6.071111727952987
Encrypted:	false
SSDEEP:	1536:8Fqz3IwGZjZ8lt0nt0NhuGO7o6LJ/TJhjYEOYULzEnr:MwYrZNQCnKhnOtthUEOYULzEr
MD5:	CC0E2455CFF19B3585C9FA781428E88E
SHA1:	93EC9326F0CEE4E7F385525B03DDF0DF89A409E8
SHA-256:	AF24B7E339CC6B80ECF7B45050533E8227D6491EED2FD8C3FF2BF22406B027AA
SHA-512:	B995CD999B36B9BD3DC8BE60A7576701CB91D18DF21934521C578047CD135C91F1027058198B1867A4D46804C0514523B370ECEC0E6691A041189011E31166A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...)4.\.........."............................@....................................R.....`..................................................[..........x............p..@...............8............................7..p...............P............................text...=........................... ..`.rdata...g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487232
Entropy (8bit):	6.340203111317007
Encrypted:	false
SSDEEP:	6144:MgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvr:MglSTPaRxFdLXyJ/ebEEkx0rqJduJ
MD5:	AD6C433A57BE03EE0C75076D6FE99CD5
SHA1:	219EE785F2C8127DAA44B298B5B2B096FCCE8D12
SHA-256:	8A180D92A2C879A3384D24A38EC8C9FD6BFD183935E61DA0B97F1C67A7EC9EA7
SHA-512:	041FB9165068D0EA879632B883B3E247336A3BB159ED46AE053B60D074A0BB231FA2DEEDD6CB2BA17AACB771413A86A3F970480AF7A2311E51702288D3B9A30E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t.....................................b....@..........................................4..........x....p.......@...(...P..@............!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892224
Entropy (8bit):	6.044434154548935
Encrypted:	false
SSDEEP:	12288:qpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so2:kZ5F/bYogxJUB9cwtHFMDp
MD5:	BB98224B0CB6F17D61AA24D7A46A08C5
SHA1:	DB78D1161EAA0C691DF76D1B6D7CC98793007BCE
SHA-256:	23A30F94360D710BB020DF76E7846AB991EDD6CA3C7F685AECF6CD1A019D451A
SHA-512:	D74291E8556911B77588D63EB20DB5D6642C31FEDD9EE186AE62D53C705F0CDBE14725ECBB8FC5FE770F45DFF05731EEBB2063A33BB78DF70B73CDCF4E86C465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................O.....@........................................../..{.... .................../...~..@...........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.630939020655746
Encrypted:	false
SSDEEP:	12288:+kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLd:SzBEGbL4Np84TQazCSiRd
MD5:	A0D2853BE8043F5FC4FEE04CFE5A8293
SHA1:	4FDF21E578739ABB4BCC938568F27897E733E229
SHA-256:	1D8C77B674F8294DB39B2CDE2873BDE5A2F6EBD65E14CAEEB58FBA94C92C1F3D
SHA-512:	FC5CE23DF55EF277D6DB898D5620697A3A061A5DD9BE63145CE71B966905CAC41B9785121709A2A0DCF8F90B76F484FAB619EB8DB40A873A867468ECF1620F99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0...............@............................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33600
Entropy (8bit):	6.281064018328684
Encrypted:	false
SSDEEP:	384:az2vV5RqtDcvnyQW7I+Ud26uiGKjzAVQjXzPishb8pe+7mNwSumexmMK6jcy:hgo7WcDGuB3Upe2m9uZxBKg3
MD5:	BED53AB8B9E406D1A8D6A85924E44282
SHA1:	19628BD3DE2BEF0EDC3622E4A7184162BD979040
SHA-256:	E5A10A74CFC36A4DCFCC9B25573B92A37B55062153EF9120B93154DB5792B3DA
SHA-512:	6F5C6945B0A982E8C94A826685158286D16173F51B10FDF1F5B9F4F93562240736A09B5F0997E995C0AF07360BACD51FA46CB8E4A3FA319519F3727FF87613E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...,4.\...........!.....F...........D.......`......................................a.....@.........................pU..W....M.......p...............d..@...........................................(...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159552
Entropy (8bit):	6.178643199247813
Encrypted:	false
SSDEEP:	3072:VYM7lLXShoSAJzKb9P+K61JJBsJgTcqTIbMNZ3mo+aGh1G:77tK+K61vBsJKcq0bMNZPXP
MD5:	F0A9D47D76E68883F04E60599EADAE6D
SHA1:	8F7BB6B9E9CB70529FA4C442ABF507A2F546E6E3
SHA-256:	2FAB0969C6E131834496428779A0809B97981F3E8D6FBF8A59632CB2DF783687
SHA-512:	18BBD1A3899C6B2F361BFA575D50D7DA29EAEF0E1C7CB50B318CECFE3150F268C1CDF30FEB5246B9F9B5D7FE36BD4A268E06595D9D3F3D86D933F14F5C43AD43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....3.\...........!.....L...N.......0.......`......................................k.....@.........................P...l...............(............P..@.......< ...................................z..@............`...............................text....J.......L.................. ..`.rdata...B...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..< ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87360
Entropy (8bit):	6.424955012685773
Encrypted:	false
SSDEEP:	1536:df1NQOOvFdve0e0ZIMhn9nA2LYK7ZOgkg6znnLnx9Inz1:/Adve07RnlhRN6znDQx
MD5:	66C5F108A058B515BBDDE628384990C9
SHA1:	0FBADFC5106056DFD269DF5EA532F69556CAE68F
SHA-256:	8D596D33CC3962B33B46D361BBC44A8088F18C09949734F3DEC54828372426AE
SHA-512:	6060EF07244385516989DF3AAD1C01E9F93B7B45A247D8D70FC5BE7A62BA96BFD22F80F0C78D178443D38796A2C7148CD3ADF4EB1A5FC430DFF5BB393492901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...$4.\.....................n....................@..........................p.......C....@.................................d........@..x............6..@....P..........8...........................P...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383296
Entropy (8bit):	6.650287803080611
Encrypted:	false
SSDEEP:	6144:yplBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lATI:O0/djgEUhWnJ2UlxqOttoICvPn/318Sm
MD5:	C3F39388BD4E6763F9734BC617388A17
SHA1:	AF5B4753F99C3F115294662876D7191DC8652786
SHA-256:	4D1F6A595889165B6A14B68D848C639748C9750C165BB4515CA3C3C67B4BA462
SHA-512:	BD8D00461E65F156686B0FC799926897845900F072F7AC10B66387E041CC7D3810ADBFB0137E9EA7B24995A11D324707D9E0FCD699D36E62ED089F46CC5ABA58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................Z!....@....................................x.......................@...............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	755520
Entropy (8bit):	6.198681499104638
Encrypted:	false
SSDEEP:	12288:IlIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxn:IvM36KkyCLW7QCwSGon
MD5:	0822EE0FF996BEB2B31EBBDD6449231B
SHA1:	7DF7F4978F3C4728CAEF9F95C6EB6C0D8CF8FDAC
SHA-256:	D727150FA7853748655E9CAA9F19F633E33BD191284703D6609984A64CB39CAB
SHA-512:	A47D25901FAD0507167E241350EC12C8D545F3F932E1B44E5F167A82263BCB97DA06B09454E8DE815EFC445088F2B1011028C3EAE5BF3F55FACAA3D9EC082815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p.....................................@.............................{....3.......p...............h..@....`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.629918098777896
Encrypted:	false
SSDEEP:	12288:tkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:LGBEGbL4Np84TQazCSiRC
MD5:	385152D096A96D1966C1042EDE38114F
SHA1:	A42D0587A2BF156C3F757778397A2E7AC8122E3C
SHA-256:	5A22FE5AF587540A9840E4F2A515564A2478DDA47AC1C81B687AC2F59C4C2FD0
SHA-512:	483E8819C6C5C1BCF725A4D6513364A5EE054E1D9100A8F42FFD2DBBFD52910CCA8E6DAF4435103C75AA2EBCA5A608BCC76EE6C531EA67C723267D9445D40256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@............................................................@............................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52312
Entropy (8bit):	6.450469916547452
Encrypted:	false
SSDEEP:	768:MsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYBZyIh9rOQ:Mza/pu/TKJ/OMpTryYzyMCQ
MD5:	4E84DF6558C385BC781CDDEA34C9FBA3
SHA1:	6D63D87C19C11BDBFA484A5835FFFFD7647296C8
SHA-256:	0526073F28A3B5999528BFA0E680D668922499124F783F02C52A3B25C367EF6D
SHA-512:	C35DA0744568BFFFEFF09E6590D059E91E5D380C5FEB3A0FBC5B19477CECA007A882884A7033345CE408FCE1DEAC5248AD9B046656478D734FE494B787F8A9F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...r.;`.....................$...................@..........................`....................................... ..q............P..................X....@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9223040
Entropy (8bit):	6.355581719432468
Encrypted:	false
SSDEEP:	196608:vL7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wbl3bc2EeJUO9WLcb0K:9lOJDm1Wrc2EeJUO9WLcbN
MD5:	8A9BDA9B9A84BD1551A09B65DFBC0C74
SHA1:	14FB48758D664917D789C21DCCB26D9D987F099F
SHA-256:	1D0F8C96F77C339A5F01822B9375131B0B0A49D6CAC45589CDB4B749DAA79773
SHA-512:	BBFB78B3652532E97F66E2DE7BFBEEFCB59254D9E626C62FF1B2E735AF2549B5483AB07739F6C9A686304C5042CDA79312028293959500BAC2A1EFE91B7732DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..f..i.t......!...*.~G...e..0............G...(m..........................j..........@... ......................Pc......`c.0"....c.............x..../....c............................`.S.....................\|ec..............................text....}G......~G.................`..`.data...,o....G..p....G.............@....rdata........H..0....G.............@..@/4...........0U......$U.............@..@.bss......... c..........................edata.......Pc.......c.............@..@.idata..0"...`c..$....c.............@....CRT....0.....c......8c.............@....tls..........c......:c.............@....rsrc.........c......<c.............@..@.reloc.......c......@c.............@..B/14..........`f.......e.............@..B/29..........pf.......e.............@..B/41......b...0h..d....g.............@..B/55...........h.......g.............@..B/67..........`i.......h.

C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7137640
Entropy (8bit):	6.481515443983134
Encrypted:	false
SSDEEP:	98304:ZRE7yGktThDyt6666666666666666666666666666666x666666666666666fww8:XGktThD0TGh/fTCRwlRvZG3XYBVX1
MD5:	0DF9039CE4896584A206A40F48A07C6A
SHA1:	34F0F9AEFD5E37B6B02D062B8AB967DC0F3D2F21
SHA-256:	1DDE27F0410E59561EAB79A6C8EF6DF2ACEC52E92C9AC646135CD91940F2BE05
SHA-512:	FCF74DD6BF3491D2E56A963ABF028EDA8DF17C11ABB793E6E3DAAD3C1E6C1AEE2F731B23CE243872B588CDF7B1B6382804F6B5204DFFC04F266BE3A329945FA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..f..T.i......!....(E..Q..:...........@E...0g..........................U.....7.m...@... ......................`P......pP.......P.............`.l../....P..#...........................FH......................rP.L............................text...`.E.......E.................`..`.rodata.@....0E......$E............. ..`.data...,(...@E..*....E.............@....rdata.......pE......XE.............@..@/4......L.....I.......H.............@..@.bss....X9... P..........................edata.......`P.......O.............@..@.idata.......pP.......O.............@....CRT....0.....P.......P.............@....tls..........P.......P.............@....rsrc.........P.......P.............@..@.reloc...#....P..$....P.............@..B/14...........Q......:Q.............@..B/29...........Q......BQ.............@..B/41......Y....S..Z....R.............@..B/55...........S......(S.

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11132168
Entropy (8bit):	6.740943395722077
Encrypted:	false
SSDEEP:	196608:kngOxqtJKXthIbi0EFrJIj35fGsX1bdXtK:kgOxqtQOUJ85jFhXQ
MD5:	CB9BE257064162076EBD4869CD97E166
SHA1:	49A8CACD48036784A413D63A242ED178BD75CBE9
SHA-256:	8A3822D52B4D460430B9E8E0FA6E6BD2C458598E4DBC2529DF7F2BDF902D2DD2
SHA-512:	013B7E7CCC77531C0D6FA81083B2F16CD0A2B2124105B2F855A478F1F114D3DBA75259B82596645E6BABD91E129E7F7F60AA85ECA32BD95F454B1A8A63B52EFB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................H...b#.....DW.......`....@.................................!....@......@..............................RX...@..\|................/.......v......................................................t........w...................text............................. ..`.itext...X.......Z................. ..`.data...\....`.......L..............@....bss....................................idata..RX.......Z.................@....didata..w.......x...4..............@....edata..............................@..@.tls....h................................rdata..]...........................@..@.reloc...v.......v..................@..B.rsrc...\|....@.......&..............@..@....................................@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21764872
Entropy (8bit):	6.6100525724973656
Encrypted:	false
SSDEEP:	393216:KEpVg+4nw7m2R8VLgZDMwyA7FWBdlY74ZV:tZR8VLg8AGYs
MD5:	D563A4D6BFCFE6884D1AC88824CB5C2A
SHA1:	710C0369915390737ED9BC19252F517D2D2939ED
SHA-256:	DE0FA71C1CFF03D657CB65A86072E964060C628AA4EB709CBE914DD772EF298D
SHA-512:	219D6307697CB12FA56020E6B2DC8FF5D13904FD318E2ED3646B294FAA1A613D838D0350E59B911023EA6F6D62CE53E402F975CAD4311D9A7DA58BD675AE2DB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................4....R.....<N.......P....@..........................`X.......L...@......@...............................b....!.8X7...........K../...0..`............................ ...............................p..:....................text............................... ..`.itext..`........................... ..`.data........P.......8..............@....bss.....................................idata...b.......d..................@....didata.:....p.......8..............@....edata..............................@..@.tls....h................................rdata..].... ......................@..@.reloc..`....0......................@..B.rsrc...8X7...!..Z7.................@..@..............G.......:.............@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388696
Entropy (8bit):	6.639766301981685
Encrypted:	false
SSDEEP:	6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
MD5:	E247666CDEA63DA5A95AEBC135908207
SHA1:	4642F6C3973C41B7D1C9A73111A26C2D7AC9C392
SHA-256:	B419ED0374E3789B4F83D4AF601F796D958E366562A0AAEA5D2F81E82ABDCF33
SHA-512:	06DA11E694D5229783CFB058DCD04D855A1D0758BEEAA97BCD886702A1502D0BF542E7890AA8F2E401BE36CCF70376B5C091A5D328BB1ABE738BC0798AB98A54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................A...............................@q.......q..........................X........(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640536
Entropy (8bit):	6.686577023894573
Encrypted:	false
SSDEEP:	49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
MD5:	D5C2A6AC30E76B7C9B55ADF1FE5C1E4A
SHA1:	3D841EB48D1A32B511611D4B9E6EED71E2C373EE
SHA-256:	11C7004851E6E6624158990DC8ABE3AA517BCAB708364D469589AD0CA3DBA428
SHA-512:	3C1C7FB535E779AC6C0D5AEF2D4E9239F1C27136468738A0BD8587F91B99365A38808BE31380BE98FD74063D266654A6AC2C2E88861A3FE314A95F1296699E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*..............................................5.......................................(............7..............X..............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265816
Entropy (8bit):	6.521007214956242
Encrypted:	false
SSDEEP:	3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
MD5:	49C51ACE274D7DB13CAA533880869A4A
SHA1:	B539ED2F1A15E2D4E5C933611D736E0C317B8313
SHA-256:	1D6407D7C7FFD2642EA7F97C86100514E8E44F58FF522475CB42BCC43A1B172B
SHA-512:	13440009E2F63078DCE466BF2FE54C60FEB6CEDEED6E9E6FC592189C50B0780543C936786B7051311089F39E9E3CCB67F705C54781C4CAE6D3A8007998BEFBF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0..............................................4...x.......................X......../..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373336
Entropy (8bit):	6.7704943019914845
Encrypted:	false
SSDEEP:	6144:faoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtOd:noPH0GgEp0gVd1ValsQXsHOd
MD5:	EDA07083AF5B6608CB5B7C305D787842
SHA1:	D1703C23522D285A3CCDAF7BA2EB837D40608867
SHA-256:	C4683EB09D65D692CA347C0C21F72B086BD2FAF733B13234F3A6B28444457D7D
SHA-512:	BE5879621D544C4E2C4B0A5DB3D93720623E89E841B2982C7F6C99BA58D30167E0DD591A12048ED045F19EC45877AA2EF631B301B903517EFFA17579C4B7C401
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b.....................................................@..........................M......@N..d.......0...............X.......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	880216
Entropy (8bit):	5.239371133407635
Encrypted:	false
SSDEEP:	12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN9S:YYF+Eyx2lzujtEIYRc1cQmsGa7ON9S
MD5:	642DC7E57F0C962B9DB4C8FB346BC5A7
SHA1:	ACEE24383B846F7D12521228D69135E5704546F6
SHA-256:	63B4B5DB4A96A8ABEC82B64034F482B433CD4168C960307AC5CC66D2FBF67EDE
SHA-512:	FB163A0CE4E3AD0B0A337F5617A7BF59070DF05CC433B6463384E8687AF3EDC197E447609A0D86FE25BA3EE2717FD470F2620A8FC3A2998A7C3B3A40530D0BAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................:W....@.........................`...........d....P..p............R..X....`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.310775528690904
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrN:KooCEYhgYEL0In
MD5:	81CBD436C2F03A3DC0AAC6035832C440
SHA1:	CAF3A1D67E7BC21F4B345286101914415200C2A4
SHA-256:	A77DC3D033841D189E456486845B2E91A84BB78C22EF081614839F81E9121211
SHA-512:	BC5F99F03BC7239540C08C4DD974A781F8C3A76DD59652B3E962810E0AD2E47F98839E4834CB1C717D1339A4B633B669FF3C3A120CAB8EFE731F8B1DFA8EEA8B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9425059e, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221866955781106
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Pazag03A2UrzJDO
MD5:	7C574604FDCA24265721E3C1AC67710E
SHA1:	DB147CC35D6AA0545637DFC8B039A88F6E76F6F0
SHA-256:	6154E4AAF19165193B119577DD0B41DBE65DEC30D1E4BBCBD1D0540663FE9A58
SHA-512:	B4C363EA84E33CC9290EC179DAC14DC751EB0C8A2A91A077D23D2D6CEB1AF6F4BE35872F691EA88870B0B3C3F317F198F4F2A9113037B3A9A98AE49C007AD29C
Malicious:	false
Preview:	.%..... .......Y.......X\...;...{......................n.%......1...\|.../...\|O.h.#......1...\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................`.%.1...\|....................g..1...\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07837600495308718
Encrypted:	false
SSDEEP:	3:nzlsetYeTss/Opym11W3c/Ci/illOE/tlnl+/rTc:PzTssTW4c6iepMP
MD5:	A6AFC8FEB1596B97CF1D20C5FD55145F
SHA1:	F764799167E56D32F3DFA7B370FA2B9903877515
SHA-256:	EAFF64714D4C588BF1DAF92791D64F4954291F56D7B3F2E1C092CF110695ECA2
SHA-512:	64CEEC501DE8069D840546D5E22BDF248F16D2E474CE006FB45B7B3F8EE9D7DCC7FAA3B18C57137F1993A3FBDBA99BD5D350336DDE25236C9F1B278A9115CB5C
Malicious:	false
Preview:	b........................................;...{.../...\|O..1...\|...........1...\|...1...\|.......1...\|....................g..1...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Remote Manipulator System\Logs\rms_log_2024-12.html

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	2994
Entropy (8bit):	5.463034075893661
Encrypted:	false
SSDEEP:	48:SpiroU8xNqcoYERDML6RLi7rNRLigbqNKKkdgmtoZh3AijHFutX3:lr0xccoJxML6RLidRLi1ongBAiju
MD5:	2B67ECBC6A00C19403FB52DF4E21EF45
SHA1:	4C6A2F4EC85C34540ACCD84AC60AFFC7157996DA
SHA-256:	BBCE6F04539BE22066117F79F5376AA39A4FA8AA373063C165E210469366043A
SHA-512:	EEBB4102DB4972DCD5A86B1091AAF1868BED501FA4640F4875B81EADD40F7546368FAF09DC77976C78C0C3D62DC06FBDAD31F08AD75D42B9CD601015802AE13E
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>RMS – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = parent_node.chil

C:\ProgramData\Remote Manipulator System\install.log

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.0069053834575366
Encrypted:	false
SSDEEP:	6:oP21LmKRL/9P21Ldd/ao9P21LhHujHO7eVVP21LwmnXjKV9P21LOLGeXkRLNWy:oP21fjP21DSo9P219Be/P21RTiP216r+
MD5:	FCF5BD2986E6F4A894B9424E679E34A2
SHA1:	79ACBF65AA21E8AD82EB0A9D91395C61CE7AF90F
SHA-256:	8155167C3E0E44BBB3DEFA4BAD37531436E109BA4D62A3F3E472FB52B02285B0
SHA-512:	DC46EF6C338FA7FE80CE3406581DE3F29200A07103DEB96110322CF694E83C8DD90B2C81824076E93FADC7B56584215290611218DE2C1C9EBC260F322E4CAA85
Malicious:	false
Preview:	03-12-2024_06:47:12#T:SilentInstall: installation 70270..03-12-2024_06:47:12#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..03-12-2024_06:47:12#T:SilentInstall: OpenService: service not found_1. OK..03-12-2024_06:47:12#T:SilentInstall: CreateService. OK..03-12-2024_06:47:12#T:SilentInstall: finished (installation) 70270..

C:\ProgramData\Remote Manipulator System\msi\70270_{77817ADF-D5EC-49C6-B987-6169BBD5345B}\Word.msi

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4557019111652925
Encrypted:	false
SSDEEP:	6:kKsr8183JFN+SkQlPlEGYRMY9z+s3Ql2DUevat:gAkPlE99SCQl2DUevat
MD5:	55B6C5EEC98BCAFD3BE82896D4ED77E6
SHA1:	BDF583ABE8894D7F2C950C8ADEB0F0F0313744EB
SHA-256:	81FF499ECC55476696C2BBAD719067A0B0F9B81EE1C07E4CD4D85DB46AA708AD
SHA-512:	D3F05F14EE53C32B8A09C76FDD503ADF7F689D87DC0434BC0F3DD0DC0F365820EFB59F62AA7D7424C4F11A42FDC2DAA35FCBAA73C0BB3B4A5E852CA648CE06F8
Malicious:	false
Preview:	p...... ........9...yE..(.................................................l.@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8457581398014917
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxbJxl9Il8u/NNcy+Y0NUxCt6vhuj8Fn+1d1rc:v79YpNN1F0yxmjjUX
MD5:	BB8DCE9BBACD48D7EF6202A84E41ABFF
SHA1:	782385F73DD9537AAE783B7D8E963DAB710E5CC4
SHA-256:	AC30A6B68F55DFD029098BA959C01EA908B7EADC2276E88429B0D7B2FDC9C473
SHA-512:	4A16C4DE75A0E3A754FA506F9572C1C34BD13A28C7B5792C81FA149F3399633EB4CA378BCAC5BC5553168DAF122C2E118D8DCA93D136FDC14AF4400BAB5CAC5E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.C.r.J.d.I.F.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.9.4.2.K.i.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.906958887195286
Encrypted:	false
SSDEEP:	48:uiTrlKxJxMrxl9Il8u/NCKQbkk90An10r/KMHrqd/vc:dYpNJakU0AIP7
MD5:	AEF4BC303EB0166544B95BD547C0BE6E
SHA1:	6FBF5E3700B4DCF6EDBE82A6347F260D8635233B
SHA-256:	6ADFFBB8025999F8A118AB878552065A3EA83550EFFD2B6EA5FA50C2B711FF0E
SHA-512:	EC53AE15BB94CF029B79E52B4759C6565D958938694F20F277F129D772CB3460DF54E48DF346318D60622D4F74821625FC0425BBE49527AF68BE659DD66A1692
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".2.t.v.s.i.0.p.k.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.9.4.2.K.i.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.00465029538022
Encrypted:	false
SSDEEP:	96:IwYpN4B0E5V0sUdx/l0WdlylVKcWR1zaIeA9ZN5ER9t/A:v6/E59Kxt7Zceha6z7Ep/A
MD5:	C8ECCA2565A05563BC972930CC46B6DF
SHA1:	ADDE901393777C34B175DE12D3BCFB46FE53C615
SHA-256:	DF4CDEC417CBE978A9FBDCC6B8E5A47A4DB6085D462A6C0FE4BCBD78290231A7
SHA-512:	8A56C911210278D218B7725EA268D1A44D23BA4CF07CA29889F11DB6EA2152040F31E9E55279ABBDA49E7488529A2C0BEFF6847DC28357D20AC343A393AEC3DC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.M.x.q.W.n.l.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.9.4.2.K.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\92BD8930.jpeg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 1428x2020, components 3
Category:	dropped
Size (bytes):	217242
Entropy (8bit):	7.641248072397463
Encrypted:	false
SSDEEP:	3072:0yKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGq:0yKKhEKBSf/vv8vyNjz9oltkyY2
MD5:	6CFFBB054A1BD06B3B1018684467A551
SHA1:	347CECCBDFCE4CB2AA96F90735C2F5975E9ABC3F
SHA-256:	E0967AD8F4F2DF25AD1343AABF1C144E48D83BC3E61E2122F5BBF9A83EA63709
SHA-512:	24726671FEFA5228737C2E3E2CC159ECA90CD770022051A07C4C059B5378DA251E70568C956CB00631E12424FF5218E7A9A9BE30B0F4D47C277FC470218F88F0
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:(......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{062F42D6-69CE-42EA-8D18-3D5B2C5B0A27}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.09783851312991518
Encrypted:	false
SSDEEP:	3:llmn/lLfn:YZn
MD5:	881EE5BD27A267B0F01FD15E90AC4309
SHA1:	39D217D0F4BDE69A9A163E9F6C5728FDE81907F7
SHA-256:	90305EA213DDD5187AC57A744160391E8F9CD88FE8C355170291294739AAE912
SHA-512:	870D03A7DE2D66778F5199708387802196419BCA134EF50F6279715EC0EEFCB01AAE209ABCB790397A855301409EC6403A3B002214CB5B07153AD4CBD7B556B7
Malicious:	false
Preview:	../.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733226420571702100_74536D0C-90FD-430F-89A9-6237F0ABD278.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.015361609667682003
Encrypted:	false
SSDEEP:	1536:8zTqyzm0GzJpqjCtnT0JaiDh3QcPyASgPOB2:e
MD5:	BFAFC4EC2787FD76304E097B5D33CA6B
SHA1:	5019C566F1907206AF0FF2EEF2D97314AEBD4DAD
SHA-256:	5DBDFFFC4F98D261F035508A5B9E8A86CEF7C5DA3C53A9F5C9A70FD014AD0F38
SHA-512:	3A7636109479976460DCBD099DFB670BDF9DDF988C9B7D68E6303D4BC69B34B5F6208218A212BBCDC2EAAF5930854C0126A7F00D307153C88CEBF13376F93905
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/03/2024 11:47:00.921.WINWORD (0x1DE8).0x1EA4.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-12-03T11:47:00.921Z","Contract":"Office.System.Activity","Activity.CV":"DG1TdP2QD0OJqWI38KvSeA.7.1","Activity.Duration":318,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...12/03/2024 11:47:00.921.WINWORD (0x1DE8).0x1EA4.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-12-03T11:47:00.921Z","Contract":"Office.System.Activity","Activity.CV":"DG1TdP2QD0OJqWI38KvSeA.7","Activity.Duration":6747,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureD

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733226420572774900_74536D0C-90FD-430F-89A9-6237F0ABD278.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCD107.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD107.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD118.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD118.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD11CA.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD11CA.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD1219.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD1219.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD129.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD129.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD14A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD14A.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD15.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD15.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD1596.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD1596.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD16.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD16.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD174D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD174D.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCD247.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD247.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD257.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD257.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD27.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD27.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD289.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD289.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD28A.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD28A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD2BB.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD2BB.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD30C.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD30C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD32C.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD32C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD38.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD38.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD4.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD543.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD543.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD572.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD572.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD67.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD67.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD6DC.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD6DC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD75B.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD75B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7BC.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD7BC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7CC.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD7CC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD86A.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD86A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD976.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD976.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD9D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD9D.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDAF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDAF.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDB0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDB0.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDB1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDB1.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDBFA.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDBFA.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDC2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC2.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDC3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDC3.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDC39.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDC39.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDD3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDD3.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDD4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDD4.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDF5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF5.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDF6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF6.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDFF27.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFF27.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDFF48.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDFF48.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDFF6B.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDFF6B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFF6C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFF6C.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDFF7E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDFF7E.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDFF90.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDFF90.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDFFA4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDFFA4.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDFFA5.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDFFA5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDFFB7.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDFFB7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDFFB8.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFFB8.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDFFCB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFFCB.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDFFDB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDFFDB.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\cab117A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab11B9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab128.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab1537.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab16EF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	modified
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cab206.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab226.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab268.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab269.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab28B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab2DB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab2FB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab4D3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab522.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab583.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab6DD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab76B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab76C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab83B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab8A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab8B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab8C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab8D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab946.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab9E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabBB9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabBE9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabE5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabFF07.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabFF28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabFF59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabFF5A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabFF6D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabFF7D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabFF7F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabFF91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabFF92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabFF93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabFFB5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabFFB6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabFFC9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabFFCA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabFFDC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabFFDD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabFFDE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabFFDF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabFFE0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabFFE1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabFFE2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabFFE3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:8Rllt:8R
MD5:	90E7CE70F12B55AB383AA11B60E8EDBA
SHA1:	389316C77B355108A46552579B52387253933F66
SHA-256:	C4BBFADD22DB4AD2B168A8A7EBC7CA25129517B9F818BDC2630B049D2FACEF9C
SHA-512:	D920E3927225E4CA77A8889290ED09D08DB4E05E74DF50BCCCE31788FB2D2A624DD443A4958EF23D9D67608520C3FAE50F3E672CE108FBB8BD4C2B87D742E1A7
Malicious:	false
Preview:	....K.........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Doc.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Dec 3 10:46:56 2024, mtime=Tue Dec 3 10:47:02 2024, atime=Mon Dec 2 20:13:15 2024, length=230038, window=hide
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.582432935872778
Encrypted:	false
SSDEEP:	6:4xtQl3m6b5qUlatl0kl//5jsVCEUO/RsZ+IcccljAlxx23LXlIRo3wrmkVIavGmV:8WsRl0sXEn3cUjAULXlrzBmV
MD5:	B5B06EA5C55E5DEED060CEE8519FB74B
SHA1:	682762817F8632D55F3914CFA5A5CB061C2A2034
SHA-256:	359903F5D216266DE1D6336B7F04EEA1A0CF7F7B67AB09F94AAE89BCD4193C7F
SHA-512:	67CF20A39C7AB27DC920BE075B632283D9BE2497E0E64A9301CD05EDB70CF9C6D983276C310D9637DAE48C0C8DD07471BA72845D33D94D2041D1B9CAA68BC3EF
Malicious:	false
Preview:	L..................F.... ...+T..yE..._.yE......D...............................P.O. .:i.....+00.../C:\...................P.1......Y.]..intel.<......Y.].Y.]..........................C...i.n.t.e.l.....Z.2......Y.. .DOC~1.DOC.B......Y.].Y.]..........................,dE.D.o.c...d.o.c.x.......@...............-.......?............F.......C:\intel\Doc.docx..#.....\.....\.....\.....\.....\.....\.....\.i.n.t.e.l.\.D.o.c...d.o.c.x.`.......X.......992547...........hT..CrF.f4... .>.T..b...,.......hT..CrF.f4... .>.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.247557492317427
Encrypted:	false
SSDEEP:	3:HqdLBCm4UcBCv:HA9hGs
MD5:	CE7BCCD008058E0D96C85995FABBDC9F
SHA1:	939A8927196DC4C5E90B32234C1484B72052F5A1
SHA-256:	2AD83E8B46EF787ABC53DC07C6D648975AF14441067BCC46017DA2B1A3DEE6CC
SHA-512:	6D2B32C16C0B0E330EDC39C20F0666CC128F5A16D82E34837D7951FE71E02B8A5BA20CD3F0ECAA58D570B110FFCCA113FC87D4CA5C4ACBE3B557B21F20CAB872
Malicious:	false
Preview:	[misc]..Doc.LNK=0..[folders]..Doc.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8NLTF30RAP39PLTFZ2IN.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T39L577Z0YJCQ8GCNCKJ.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF2d77a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\Installer\440b40.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\440b43.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI10DE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1447471
Entropy (8bit):	4.935925476310217
Encrypted:	false
SSDEEP:	24576:gMMMMMMSLLLLLLLFMMMMMMSLLLLLLLsMMMMMMSLLLLLLLi:gMMMMMMSLLLLLLLFMMMMMMSLLLLLLLsb
MD5:	1CA6AFDAA28C89A3DA9D147451DE3DA0
SHA1:	E8B38F0FCA62157CBCFF3FA1D743412E86F748F7
SHA-256:	CC5FFE2CC894DDA983B797CB7E4014282F9B5120C62FE7B2F167D0041CFC98AC
SHA-512:	523841C4DB1AD1826B4E4CE889CF23B68BF930BDFF12B7002E3DBEEB94310EA8289550CE28DBEBC3E615B1414034D96E0EE3BA9D660EE65D8E270021C04CD608
Malicious:	false
Preview:	...@IXOS.@.....@.5.Y.@.....@.....@.....@.....@.....@......&.{77817ADF-D5EC-49C6-B987-6169BBD5345B} .Remote Manipulator System - Host..Word.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{134AA6F2-2A49-44F2-A7A5-B7B9233956FA}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.]....@.......@........ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2....@.....@.....@.]....&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}8.C:\Program Files (x86)\Remote Manipulator System - Host\.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}...@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}D.C:\Program Files (x86)\Remote Manip

C:\Windows\Installer\MSIF85.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{77817ADF-D5EC-49C6-B987-6169BBD5345B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1611785889279091
Encrypted:	false
SSDEEP:	12:JSbX72Fja+AGiLIlHVRpzh/7777777777777777777777777vDHF5t07x6uPp01z:JzQI53vt016uy8F
MD5:	ED79AE62C6D5ED3859C11A201E2F69D1
SHA1:	BB576EEC94485660268EF49FCBEE5D02C86172B4
SHA-256:	C6C17A711852130461BF83871470CEFB7E28FF45F56545782888A9A77AF715FA
SHA-512:	0452195DF74E216DC02F899B79A15FEDDC5F4981CADDB70C945F2047B97A2FCAF836F1FB263E0AC6AA2751D53295992E0E3BD58CD13DF65A12E800F8B55422A0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9233781749241923
Encrypted:	false
SSDEEP:	48:58PhhuRc06WXOcjT5GNsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOdS:0hh1ajTANsUGkOzs9t4rqvGkOzs9Hf
MD5:	644E7622B10943EDACD2EE57FD350584
SHA1:	DA5277A2FBD14BE0AA0D0CA9F9C97A68EE903EBE
SHA-256:	17C1F2A1CE27DD40E6A1A85DE695A51ECF1E44FDF401206FC34A57F3241EC4A6
SHA-512:	FEEBAF0BB5F2FE2FB2DEE488C39EE32D7343FA77D246876FA13A7376C6EE2E267BA83CAA5237A58F0E776C1C78168155D967CBF54A2998274FD5A8EDA19E9CC7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79000
Entropy (8bit):	5.817675016279098
Encrypted:	false
SSDEEP:	768:/MAyYdTmPJbgqcnDckJ42T1IPAMxkEo2T1OtoAMxkEbK:/1U81ckJ52xVPxnK
MD5:	E8CBBBE641AA6205C0E028CE7DC72CFE
SHA1:	E845FB6044E5F611F4F990B76AA4762FAB6E96C9
SHA-256:	61481606FE3FF53C9483586B4A95181D96F5679667ACCD582166069B10233D77
SHA-512:	D12E6BBA83F1B41BB2B937B315C5CDD3ADFA60C318AD1E958D99251822810739D2C6EC75B664BBC3116B0CDBBBFA4BEBA234B8C604F303391E21CDA0C24767E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(.......t0...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	5.60723121147002
Encrypted:	false
SSDEEP:	768:RdMAyYdTmPJbgqcnDc/soJP2T1qAMxkEvQ2T1h8uAMxkE4:/1U81cLJOGxF/hxM
MD5:	F0F36966AD2B91DBE0C8B9D4E0A1AB0E
SHA1:	B7787445DDD42A3B4753AFC0B02B270DDC1693FC
SHA-256:	BE3C9594F315F2CE2698DFF54F7B41F012B25BF208DD88CEA7AC92936EC84AE9
SHA-512:	B178A35B3F0A3CA67D632901C1F0AF309F51267DFA827AE029475C63BCF2BA51694C717C94989D7E457E915DAE74B43C3C6B405113249A7B1FF0E9BAE67E0949
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.........................................................................4T..(.......\................d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.6899574334599645
Encrypted:	false
SSDEEP:	1536:c1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL+:UjcT6uuuutMMMMMMSLLLLLLLeYTZg
MD5:	6A9AA00C428A946F9A5C5546A458ECA0
SHA1:	06A70B197DEE2FC106576C6719CFF046D2747396
SHA-256:	16601981E37F2FE16B8E0EA4626ABF57013458B63D1A71C8FA3B5080F3C191F5
SHA-512:	EADDEE089D18ED744BB1DCAAA98A8F6E201022432C55D037D2A7EF994532197EF595E44DEEF9DB0CFAE8ACA50F4AB90CEEDB49F8E920E6B4FAF6C60B6EFEDD51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................v.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690218208041496
Encrypted:	false
SSDEEP:	1536:R1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLe:DjcT6uuuutMMMMMMSLLLLLLLeYuGVk
MD5:	AB85C5EEAD096C4E5D0A2914C24F59B2
SHA1:	E189F9BA583B0A4EEE1C817C9DA8A5D72A038A83
SHA-256:	F4F656CC3CD99ABC4CFC1A70BD77C52E36D59852987BE530E131CEF8238F4BA7
SHA-512:	E70ACF9FCA9F0378FAC97421550984FF166D8D1D83F423400B108E804CA876EA6D7517398637D64C34CC0E46C14048BB9F50C8268D993FA983DB6B0E44A9C352
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................>.......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{77817ADF-D5EC-49C6-B987-6169BBD5345B}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.690232052098797
Encrypted:	false
SSDEEP:	1536:o1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLU:IjcT6uuuutMMMMMMSLLLLLLLeYFuv
MD5:	03A18CE97AA1C45D834524B8A408BC17
SHA1:	72ABD8B4AC974928684B6D089F8573C70D431808
SHA-256:	0ACFCA29B6128E0161B4E6D93FFF7686A96128016846625763DAB7F9CE059DEF
SHA-512:	2A2DC903E4179EC83BB4FA557FFCCE8BA3D8FC175E9C817D34BA186704ECF06A281D96D35B12B8D54FE35683030942FDC9A3A1FDFDBEAA755A60436F3C7B3483
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@........................................................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375180090542907
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpErg
MD5:	E91242520C27FDFA440A3FC93C98876F
SHA1:	98CD944744AB3FA7A41424C657D4F6106FE1AE70
SHA-256:	024435C116F55577D006D0D730DABDB878771B1D782D057F8D028F5CF1D74C2D
SHA-512:	A04915F6DB5250226E552A844803C12FEB8136CE2FF19BF720BCAA8EFE8F7E7DF9BFF3067BB8CFAC4ABFA1388442DEE828AC00EF0E0D44F9F6779B6D98986E28
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.607072872097237
Encrypted:	false
SSDEEP:	24:Vk1IRjhPyjI5w6GlktA7FPSGBAS7jF78oekZdCrphruWeI8h6FfymkBZGfKkamou:HwI66lKpj9BdCusxIsfLamo3T6
MD5:	92B4768535FBAE2B8196873594AC03B3
SHA1:	D2C252C68467CFE5CF09AD4565F8CC68FD39691D
SHA-256:	FE9A668474C969291050953E87A2684F5B9E5AA6368D0CC83FBDF70FF824448E
SHA-512:	607E281D338AB15F2D79B6D06EDB795649866A22B09C7ED2782D8DFFE084492C1737866E6DA89C533406EDD7AA9AEF6E8CD1135D6ADB96941B3C48CDB384C80C
Malicious:	false
Preview:	0..........0.....+.....0......0...0..........j......t........20241203090447Z0s0q0I0...+..............B..M.%..Dg..5 .....F...x9...C.VP..;..w.......T..r...G....20241203090447Z....20241207090446Z0....H...............M.w.wo.eo..2).?#V.g....0.......V.:....q....b......Fl..\...v1q.?.#.Ig.....Tk.x..O.@..<V..Z.:.5.e.IA.2Wo..^s...j.7.].[.$.&.h.\|....p..&yf.?..."......k..!w.....$8.5?.j.].a:`fId.+.,=.@}b.-.=W.g.p..@..Q......s.. .f.'..\|a.....[.....%..>..%..z.p....0...0...0............\|.w.7@$.L.!...0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...240717031756Z..250215000000Z0g1.0...U....BE1.0...U....GlobalSign nv-sa1=0;..U...4GlobalSign Code Signing Root R45 - OCSP 1.2 202411070.."0...*.H.............0............U...;..pc+..o.K..0...6.'...F.C..}.....%E..F.q.-\.u{..$.....#8.,{...^OEQ..P..~ZU..f.0........Ky+..(..q.............sy...e.0...Z.]X1.A....z.....g.p.{.~,u.0R..f.SOx".Q_.{......`T.&[&2..P\|.......h.Z(A;.3.]$...k`.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.601858951809015
Encrypted:	false
SSDEEP:	48:+sU2OhYVI2j37nIxCw5DgSUnpU446J8WpNTE:FmYVI2j37n4Cw5MSiw6mOTE
MD5:	1B4D8125E67CB516C9D001CCB2A999BC
SHA1:	9CAEE4DA6C9D3F0BBE42A10F8CE37A872E24FBD9
SHA-256:	657B6EC6B34F8BAD97EB5966F4D8E224AD0A6B6DAF6CDD19FBD06422320BAF70
SHA-512:	523CC60E8F14610D23987227E4C1FF9E113E78936B994570402C9EE091E257CA5AB83514A54B7C1B4969DEA835BF88735B9A85150FEDA6EFB7132D279FE1C92C
Malicious:	false
Preview:	0..........0.....+.....0.....r0..n0............`...H,.&...=...20241203095041Z0o0m0E0...+...........r...nK..._..[.Q.....$..kw...Y.!gdv.x..vF...M...k3....20241203095041Z....20241207095040Z0....H..............UJ.U.o4.+S..;....mW..0....S....../.9..U0................te9.gR..n..;AtfPB$..p\.z.....2..s...{.].].@..Nbq,..Y.vSJ.0..$.DU.Fsv.3.u...2.{/.....P..=...q..H...z..x...w.C`Q(_....@.....................A"...C.o...Q.........c.,Js...'...._..N$Rh4.R.Z....0...0...0..........f3...z.....0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 20200...240920234113Z..241221234112Z0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'gsgccr45codesignca2020CA OCSP Responder0.."0....H.............0.........+..6b.I...$...f.C.K?}.s...r;.y.m,]q.....@.N.2..x.F5Y........%.).....>.yH.....*.\.9.<..ns..,..jQ.....~..V.N..Y.........8.a..Rg..A3....[.p<......by..Y.y...9....7%.%.i$..I..T~........2i....R..rW..~.!..e...;....\.9;<L.._..I.Fe.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.48674266225811
Encrypted:	false
SSDEEP:	24:qMcjIZwMV4Z0+v54Lvu94gpNORwfF7YpQfvmE1yPq8hruWa2tHP+HLuuDXXWLaH:J7uMVm0+v6LWbORK9q3nPq4uRY4Luubf
MD5:	888FC9DCC34F2A8710436B5F311CCB7D
SHA1:	7E61C4C4039A45A47B35201DD19283E26B104AA6
SHA-256:	F10B877B9ADE37233E24F4F8CB2B83A8C191E7BA37B979353DC0BC56B486FC28
SHA-512:	AFF0909157644C0B18FC9063F1DE471319FBE3D360BCC5E80BC5AAAEB23D4EC1091273B6F8D1D204AED2473E04542930E393D63F97FB28D327BC81C126F61402
Malicious:	false
Preview:	0..........0.....+.....0.....}0..y0......$L..\|6..h(4.]........20241203094135Z0s0q0I0...+..........h.$..y.u.3.V..G.....K...E$.MP.c.........x..BEp.A.o...T....20241203094135Z....20241207094134Z0....H...............x=...Hx.o>.A...S?+^.@GU.O.F...t....rL[s..A.7.p......n.8.G1S?....J..`..u?...b..}.r.C...c..@.w...i.s.W..0E..z.+.9...a.../='7...Ld>.)....'...E../8.h.i...=..ka..%..}kW..+./s.X."....>.Q?p...{.....l.U>o...14.Z.lu..\yGG...2...^...}..%0S}Q.............0...0...0............\|.X........-..0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...240717031720Z..250215000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign Root R3 - OCSP 1.2 202411070.."0....H.............0..........U\m..$.o@E.<.c..).S..L...HN.<W\|.F .........h...zo..vk..%M.".j.P..U!/..v.Th.R..(.i..$P....^l..@qe....q.l..6....cB.:.;.KU......J..>.....$..(.h J.6;.....N..(r).i.*...o.<-..c..2.]<.7r.../.Ni..}q...8B.LT./'...=b.>....C........"..

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	532
Entropy (8bit):	3.9575073130443283
Encrypted:	false
SSDEEP:	12:6w/z/DWzJqe3KQj22iv8sFF1gUeMalCrlQNlVgfMk21PUJS:dz/DgJRjYvP+U7uCKlCMmI
MD5:	3041A242B1C9FB2E91341FF3B066E5C3
SHA1:	0E3A3B70A79EE5FE1F20911ACF4321C42242EDAF
SHA-256:	1B5B8E97C918077ECCE0E3158C3F0DA25F90C26D13B50DD69B77715E03BCE416
SHA-512:	1F99C742C4C5F3945E99198EEFEBC703D0B51C1D15D9CC3A27DCDFF01855A582F5523D342D166CF8BE803B8143603F9A926FFE9D8CDB05036E952E377D68CE89
Malicious:	false
Preview:	p...... ....J....0..yE..(.................fbE...K...H...................K...H.. .........fbE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.Q.V.F.Z.P.5.v.q.h.C.r.t.R.N.5.S.W.f.4.0.R.n.6.N.M.1.I.A.Q.U.H.w.C.%.2.F.R.o.A.K.%.2.F.H.g.5.t.6.W.0.Q.9.l.W.U.L.v.O.l.j.s.C.E.H.e.9.D.g.O.h.t.w.j.4.V.K.s.G.c.h.D.Z.B.E.c.%.3.D...".d.2.c.2.5.2.c.6.8.4.6.7.c.f.e.5.c.f.0.9.a.d.4.5.6.5.f.8.c.c.6.8.f.d.3.9.6.9.1.d."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	3.914640336768837
Encrypted:	false
SSDEEP:	12:pexoXyzfDWzf79bLgLzK8sFAY6ealztksMuE8lJS/:pexXzfDgz9YLmvqY6muNJS/
MD5:	09BBF961109107FBE772BED1A98842C8
SHA1:	05C7398A538D7173CFF85C1889243DE893F770DD
SHA-256:	41321C0DD6E3502297A68B44C9F18A0C99B42D6A881265876EDF581E9EF86D1E
SHA-512:	2F7791CFC7D5DB2454D5ECB87F09C20FBD10ED0D3D823D23027ABD119A2B5815762CAF5D695483E3F7D4D442F0C42FA88C6145160D6B9306E0D2095E0381C60C
Malicious:	false
Preview:	p...... ....V.....D.yE..(.................:.hE...XIy.H...................XIy.H.. .........:.hE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0./.M.E.0.w.S.z.B.J.M.E.c.w.R.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.L.u.A.3.y.g.n.K.W.%.2.F.7.x.u.S.x.%.2.F.0.9.F.%.2.B.h.H.V.u.E.U.Q.Q.U.2.r.O.N.w.C.S.Q.o.2.t.3.0.w.y.g.W.d.0.h.Z.2.R.2.C.3.g.C.D.H.Z.G.D.p.D.i.h.E.2.3.%.2.B.Y.N.r.M.w.%.3.D.%.3.D...".9.c.a.e.e.4.d.a.6.c.9.d.3.f.0.b.b.e.4.2.a.1.0.f.8.c.e.3.7.a.8.7.2.e.2.4.f.b.d.9."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	3.9846791409999285
Encrypted:	false
SSDEEP:	12:uAdLkIzVDWzFU8iv8sFt4QAfROA/pULrnnKsPDD/:CIzVDgFUhv/ofROS6LzKgD/
MD5:	277832EE0750AB75CC27D75E98079A38
SHA1:	2F31347B6D0A94461FAD7FB456E5E905AAD12A15
SHA-256:	B518B39B61505B88F2972DBC4995555851EDFD59CF747087539576E7A8032CD5
SHA-512:	EDBDF5F2DC02CA79C06DF1FB7BAB7F00DF27ED4EB533D3574CF5F477B232384EF9F72A346472671D8C36384314CD8F0AFB7D0904762B7124A712F52B066A176E
Malicious:	false
Preview:	p...... ....2......yE..(..................gE...[.3.H...................[.3.H.. ..........gE......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.r.o.o.t.r.3./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.1.n.G.h.%.2.F.J.B.j.W.K.n.k.P.d.Z.I.z.B.1.b.q.h.e.l.H.B.w.Q.U.j.%.2.F.B.L.f.6.g.u.R.S.S.u.T.V.D.6.Y.5.q.L.3.u.L.d.G.7.w.C.E.H.g.D.G.E.J.F.c.I.p.B.z.2.8.B.u.O.6.0.q.V.Q.%.3.D...".7.e.6.1.c.4.c.4.0.3.9.a.4.5.a.4.7.b.3.5.2.0.1.d.d.1.9.2.8.3.e.2.6.b.1.0.4.a.a.6."...

C:\Windows\Temp\~DF10CB174FE5D27D22.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.27555231248128464
Encrypted:	false
SSDEEP:	48:2IOYXSBwdgfdguOdghRXdgkdgpdgKdg4SKdgfdguOdghRXdgkdgpdgKdgt6Adgaf:HOGqvGkOzs94UGkOzs9t4N2
MD5:	8A367515AA7151CD4C8766E1CCD242A0
SHA1:	84D54B1B903167C4B71871681CD6BA10DFBD170B
SHA-256:	585B731B4F632717413A55A27A5EFBF0DB82A471A82D0F9296D3628BDD71EC9E
SHA-512:	F558F1EE2EB4280BE5652D560042F02B32F6382929F8015B71F2867939D9E92E5ABA323C7AFC6CC2B99A0607A56E1B51D6FC82BC00B31B47A45B92D7EF3DDE83
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF115B2444053E6B45.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1EEDB4C1C422AB4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9233781749241923
Encrypted:	false
SSDEEP:	48:58PhhuRc06WXOcjT5GNsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOdS:0hh1ajTANsUGkOzs9t4rqvGkOzs9Hf
MD5:	644E7622B10943EDACD2EE57FD350584
SHA1:	DA5277A2FBD14BE0AA0D0CA9F9C97A68EE903EBE
SHA-256:	17C1F2A1CE27DD40E6A1A85DE695A51ECF1E44FDF401206FC34A57F3241EC4A6
SHA-512:	FEEBAF0BB5F2FE2FB2DEE488C39EE32D7343FA77D246876FA13A7376C6EE2E267BA83CAA5237A58F0E776C1C78168155D967CBF54A2998274FD5A8EDA19E9CC7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF29D4CAD718A566F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9233781749241923
Encrypted:	false
SSDEEP:	48:58PhhuRc06WXOcjT5GNsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOdS:0hh1ajTANsUGkOzs9t4rqvGkOzs9Hf
MD5:	644E7622B10943EDACD2EE57FD350584
SHA1:	DA5277A2FBD14BE0AA0D0CA9F9C97A68EE903EBE
SHA-256:	17C1F2A1CE27DD40E6A1A85DE695A51ECF1E44FDF401206FC34A57F3241EC4A6
SHA-512:	FEEBAF0BB5F2FE2FB2DEE488C39EE32D7343FA77D246876FA13A7376C6EE2E267BA83CAA5237A58F0E776C1C78168155D967CBF54A2998274FD5A8EDA19E9CC7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4B8654DEC0FD0E1F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF744A21FE4EE440A6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5164935908667418
Encrypted:	false
SSDEEP:	48:LwZuUJvcFXO3T5XUky/NsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOo:0Z4qTZtsNsUGkOzs9t4rqvGkOzs9Hf
MD5:	C0038655D7AE5DE8D232EE6D2EB25258
SHA1:	BCEFEB5D89A84E055E3AD260D195CEAC2316ECE9
SHA-256:	494947D770B1B79320DEA0D647F8D52ABDD30779CC38F796F8AE002A2E886684
SHA-512:	0A859F4B56F269F1124738A7E71BE5AF419D17E72351686852FD0BB6F2FF34A26228F68C5C17FAD4E4048884EAD791C1CF5FADA53F6BB04460415DA610C2ACD2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7BB5E67F64A8891E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7C31E1CAC678C7D8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9918B2BA0F0A322E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5164935908667418
Encrypted:	false
SSDEEP:	48:LwZuUJvcFXO3T5XUky/NsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOo:0Z4qTZtsNsUGkOzs9t4rqvGkOzs9Hf
MD5:	C0038655D7AE5DE8D232EE6D2EB25258
SHA1:	BCEFEB5D89A84E055E3AD260D195CEAC2316ECE9
SHA-256:	494947D770B1B79320DEA0D647F8D52ABDD30779CC38F796F8AE002A2E886684
SHA-512:	0A859F4B56F269F1124738A7E71BE5AF419D17E72351686852FD0BB6F2FF34A26228F68C5C17FAD4E4048884EAD791C1CF5FADA53F6BB04460415DA610C2ACD2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB554337DDEB739D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5164935908667418
Encrypted:	false
SSDEEP:	48:LwZuUJvcFXO3T5XUky/NsSKdgfdguOdghRXdgkdgpdgKdgt6Adga2SBwdgfdguOo:0Z4qTZtsNsUGkOzs9t4rqvGkOzs9Hf
MD5:	C0038655D7AE5DE8D232EE6D2EB25258
SHA1:	BCEFEB5D89A84E055E3AD260D195CEAC2316ECE9
SHA-256:	494947D770B1B79320DEA0D647F8D52ABDD30779CC38F796F8AE002A2E886684
SHA-512:	0A859F4B56F269F1124738A7E71BE5AF419D17E72351686852FD0BB6F2FF34A26228F68C5C17FAD4E4048884EAD791C1CF5FADA53F6BB04460415DA610C2ACD2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC37BCDF51AD3764F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06843743119485104
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOZft07x6qkWrkoVky6l0t/:2F0i8n0itFzDHF5t07x6uC01
MD5:	B23A8F32998499DA774A3479193D91FB
SHA1:	0FE95AAD29FA238A9488C7C9BF7E1E265A18497B
SHA-256:	3272D0750CE59B4FF12F23F507659A50D8EC4C4562130BD41A529780E660C33D
SHA-512:	DBF24A27950DB9528F76E5FCD10F74518083DBBEBB583EA4CDD4295B3122B16640F7AA9C5E3D27DF38E2B0B40E89FF575FA3BBAF249FC0DBB25A4CAA9F7FB30E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEC152C20D243E0B5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\intel\Doc.docx

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	230038
Entropy (8bit):	7.636957641054668
Encrypted:	false
SSDEEP:	3072:nzyKKhARKP6+FeRJhaigk8Ukyhxv8vyNrwyJN2EiXo4EaCNSltkprZvyYqZtGVVu:nzyKKhEKBSf/vv8vyNjz9oltkyYzcZ
MD5:	773D2787D661474A840B907C8A22D4E9
SHA1:	A6A0E3C4AB4063BC74C65D6EC0CB43B67F1D767F
SHA-256:	BA82FE356B21118D92B04A74EF8466A59F4802FD9B061F6E9A28E16CF7A5A8B3
SHA-512:	7EC868F9B7B47A757BBB5ABF5639F97C47D79AC55DD07954F3EEE93384B555F7C4C817B687C8C486DC97F4174A8CC04DEED342E8ADD6EA2EDB5EE381FC612BEA
Malicious:	false
Preview:	PK..........!..A..f...T.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E........tQUUH.},.HM?...../....;@..(..I6H0s.=.xF..V..\|...d..H..[!M....[.H....LY.9.B ....h.u..T...E......Y.....z."...:..X..~0x...&... ....l.b.......$.Mc....+..@.j<.p.a.).Y.:].q@..2T.=a!].........}...R@2e>.3.]tm....Fev....-...Wn.[.!.w.*k+.I.....q. \.....Qp...s/...W..c..R`...\....xj.....mNEb..[.p.....?..:...(O.um"Z.=.T.@.8.M.8........PK..........!.........N......._rels/.rels ...(...........................

C:\intel\Word.msi

Download File

Process:	C:\Users\user\Desktop\442.docx.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.2, Comments: This installer contains the logic and data to install RMS - Host 7.2, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.2, Author: TektonIT, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Thu Jul 18 02:24:09 2024, Create Time/Date: Thu Jul 18 02:24:09 2024, Last Printed: Thu Jul 18 02:24:09 2024, Revision Number: {134AA6F2-2A49-44F2-A7A5-B7B9233956FA}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	26864640
Entropy (8bit):	7.924911310016854
Encrypted:	false
SSDEEP:	393216:3fWbJGFHH0km5pmwUs1211e50MRZDzPHPRn9xrUVaWILZPLM4ShshVK6KZ478Qic:3fRLmf21sq8P50dILZPLzVK6D
MD5:	24F15E659ECB67862F4C6E72726BFCA7
SHA1:	75D90172D7A315A31A484629DC8573367F3E544A
SHA-256:	F11C06F1FD567E26FB4CE9999749516B6E47ADE4EE0B7B875A75A5CBFB74DC04
SHA-512:	913C9FB7FDCA7F9F7DD7077C34092E76E42D88802406C9A5F6E8AA0C21E4F21FEE850A39B95982EFE9ED4A2D022A95C30739CC20DC65F3C6722B6022D8F76B3C
Malicious:	false
Preview:	......................>...................................8........6........................................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........;................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...<.......=.......?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...n.......P...Q...R...U...........Z...W...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\intel\~$Doc.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.634028566518496
Encrypted:	false
SSDEEP:	3:t4qKF0n4ejBl4XRre0HmzF/gb/j+RcClaaatO:JK+4ejBlYRreAmdgbL+waaM
MD5:	AE0D713FA3E97CE94286AA2DC08A43DE
SHA1:	A895E451E04FBF694318A08DEA7881AB901F3264
SHA-256:	C3D39C0EA20BFF4B0AF08EDA8F81A35201773151B83C7A5632720BDEE8BF7C25
SHA-512:	C9803D75558E275B477749AAF83ECA777D5C8B071032AC03E8A4812CA8BB63CEB42087C257FFD66D5E5EE65936FE9C88BFD892E28FB40D242D40118413DA7EAA
Malicious:	false
Preview:	..........................................................m......6..o......Y]lW..R.KIY..R.+k.m.Yv2.}...Ou{=.W.^m.7E}'...C..EyE......."....}.j.....T...=`j

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998140922332344
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	442.docx.exe
File size:	25'141'051 bytes
MD5:	fb8117b1a3f0924100fbc209dbbb1bb1
SHA1:	9d18c954eae8e8f8437d4e32d0b685f3f51b982b
SHA256:	beaa1498a67bab02bc4c08f00bde36489aaa86ad8b01ee70b477452a08d360ec
SHA512:	fcaba4304f26eefa476202e17ca85c3f994d2086f78fa86f1d73f7d6c926825a4ac3b02ceae2d8cde3583f02fdbf87139741035368f6d4b77c4f8c790df330fd
SSDEEP:	393216:bnD8YsCFVxnq/mIhNAl2543UCCCQrTTNi5NRmclImNm/U29ieL:bgYlFV8/1AbOrXNihH29LL
TLSH:	14473325EE400AB1E2FAD47098159413D63C3C5DC228B2A722F997287FF7B755B67388
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0b03084c4e4e0383

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7774E9F8B8h
dec eax
add esp, 28h
jmp 00007F7774E9F24Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F7774E9E6D3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F7774E9F3E3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F7774EA13F7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F7774E8DC63h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F7774EA04B2h
int3
jmp 00007F7774EA6694h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1558c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1558c	0x15600	50f0a4d841d0856138dbb9d7187108bf	False	0.1905953033625731	data	5.443581422941128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x7109c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72648	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 15118 x 15118 px/m	0.06374955637051934
RT_DIALOG	0x82e70	0x2ba	data	0.5286532951289399
RT_DIALOG	0x8312c	0x13a	data	0.6560509554140127
RT_DIALOG	0x83268	0xf2	data	0.71900826446281
RT_DIALOG	0x8335c	0x14a	data	0.6
RT_DIALOG	0x834a8	0x314	data	0.47588832487309646
RT_DIALOG	0x837bc	0x24a	data	0.6279863481228669
RT_STRING	0x83a08	0x1fc	data	0.421259842519685
RT_STRING	0x83c04	0x246	data	0.41924398625429554
RT_STRING	0x83e4c	0x1a6	data	0.514218009478673
RT_STRING	0x83ff4	0xdc	data	0.65
RT_STRING	0x840d0	0x470	data	0.3873239436619718
RT_STRING	0x84540	0x164	data	0.5056179775280899
RT_STRING	0x846a4	0x110	data	0.5772058823529411
RT_STRING	0x847b4	0x158	data	0.4563953488372093
RT_STRING	0x8490c	0xe8	data	0.5948275862068966
RT_STRING	0x849f4	0x1c6	data	0.5242290748898678
RT_STRING	0x84bbc	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x84e24	0x14	data	1.15
RT_MANIFEST	0x84e38	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T12:48:20.628368+0100	2849354	ETPRO MALWARE Remote Admin Backdoor Related Activity	1	192.168.2.4	49873	111.90.147.125	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 12:47:25.151310921 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:25.272533894 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:25.274496078 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:25.278033018 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:25.278065920 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:25.397968054 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:25.398150921 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:25.398315907 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:28.386300087 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:28.437257051 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:28.472431898 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:28.593050957 CET	5655	49806	95.213.205.83	192.168.2.4
Dec 3, 2024 12:47:28.593106031 CET	49806	5655	192.168.2.4	95.213.205.83
Dec 3, 2024 12:47:28.798655033 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:47:28.918790102 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:47:28.918874025 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:47:28.919806004 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:47:28.919910908 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:47:29.039983034 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:47:29.039999962 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:47:29.040036917 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:47:57.524679899 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:47:57.577951908 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:48:18.859935045 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.860985041 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.864202023 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.865351915 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.865639925 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.866728067 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.980422974 CET	465	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:18.980516911 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.981054068 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.981076002 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.981492996 CET	5651	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:18.981563091 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.982074022 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.982089043 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.984752893 CET	55555	49872	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:18.984813929 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.985318899 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.985332966 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.985867977 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:18.985913992 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.986030102 CET	5651	49874	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:18.986085892 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.986464024 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.986479044 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:18.986545086 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.986561060 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.987034082 CET	8080	49875	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:18.987082005 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.987467051 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:18.987488985 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:19.101052046 CET	465	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.101063013 CET	465	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.101952076 CET	5651	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.101958990 CET	5651	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.105441093 CET	55555	49872	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.105448961 CET	55555	49872	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.106424093 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.106468916 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:19.106477022 CET	5651	49874	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:19.106493950 CET	5651	49874	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:19.107348919 CET	8080	49875	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:19.107364893 CET	8080	49875	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:20.628106117 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:20.628274918 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:20.628309965 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:20.628328085 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:20.628346920 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:20.628367901 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:20.749510050 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:20.749521017 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:20.749560118 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:20.749568939 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:20.749576092 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:21.465563059 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:21.515513897 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:21.618267059 CET	55555	49872	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:21.618726969 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:21.618794918 CET	49872	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:21.645543098 CET	5651	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:21.645606041 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:21.645677090 CET	49871	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:21.738769054 CET	55555	49872	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:21.765778065 CET	5651	49871	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:22.469597101 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:22.517391920 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:23.484899998 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:23.531146049 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:24.514514923 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:24.562436104 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:25.501291037 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:25.546819925 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:26.516609907 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:26.562498093 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:27.519820929 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:27.562378883 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:28.531864882 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:28.578003883 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:28.583981991 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:48:28.640533924 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:48:29.547425032 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:29.593766928 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:30.563323021 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:30.609276056 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:31.563493013 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:31.609278917 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:32.578844070 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:32.624964952 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:33.594439030 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:33.640573978 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:33.985043049 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:34.000432014 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:34.000592947 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:34.148509026 CET	465	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:34.168448925 CET	8080	49875	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:34.168492079 CET	5651	49874	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:34.610203028 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:34.656290054 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:35.625579119 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:35.671787977 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:36.625951052 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:36.671775103 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:37.664952040 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:37.718661070 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:38.657680988 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:38.703062057 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:39.672827959 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:39.718694925 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:40.688280106 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:40.734389067 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:40.922863007 CET	8080	49875	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:40.922938108 CET	49875	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:40.923064947 CET	5651	49874	78.138.9.142	192.168.2.4
Dec 3, 2024 12:48:40.923109055 CET	49874	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:48:40.947629929 CET	465	49870	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:40.947688103 CET	49870	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:41.704114914 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:41.749943018 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:42.719583988 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:42.765577078 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:43.735340118 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:43.781156063 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:44.750711918 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:44.796941042 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:45.766261101 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:45.812485933 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:46.781950951 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:46.828136921 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:47.782299042 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:47.828047991 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:48.797636032 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:48.843799114 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:49.813033104 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:49.859337091 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:50.829871893 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:50.874988079 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:51.845088005 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:51.890564919 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:52.859702110 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:52.906188965 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:53.860264063 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:53.906295061 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:54.881376028 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:54.937457085 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:55.894876957 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:55.953347921 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:56.906825066 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:56.953068018 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:57.923914909 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:57.968699932 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:58.938452005 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:58.984359026 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:48:59.954694033 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:48:59.999954939 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:00.680799961 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:49:00.734385967 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:49:00.972513914 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:01.015609980 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:01.974072933 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:02.015649080 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:02.984832048 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:03.031224966 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:04.000684977 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:04.046838999 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:05.018739939 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:05.062491894 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:06.032336950 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:06.078315020 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:07.047650099 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:07.093864918 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:08.063457012 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:08.109344959 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:09.078840971 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:09.124965906 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:10.080544949 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:10.124994040 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:11.094476938 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:11.140595913 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:12.109952927 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:12.156243086 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:13.125694990 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:13.171948910 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:14.141441107 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:14.187490940 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:15.157902002 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:15.203200102 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:16.173125982 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:16.218911886 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:17.188031912 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:17.234389067 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.203852892 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:18.250016928 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.873682022 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.874320030 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.878911018 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.879354954 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.893954039 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.993782997 CET	5651	50002	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:18.993911982 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.994275093 CET	465	50003	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:18.994452953 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.994533062 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.994554043 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.995029926 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.995054960 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.998851061 CET	55555	50004	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:18.998917103 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.999244928 CET	8080	50005	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:18.999311924 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.999471903 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.999495029 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:18.999773979 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:18.999785900 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:19.013926029 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.013995886 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:19.014477968 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:19.014565945 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:19.114450932 CET	5651	50002	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:19.114463091 CET	5651	50002	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:19.115071058 CET	465	50003	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.115078926 CET	465	50003	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.119533062 CET	55555	50004	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.119659901 CET	55555	50004	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.119671106 CET	8080	50005	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:19.119678974 CET	8080	50005	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:19.135252953 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.135307074 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.219476938 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:19.265634060 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:20.286286116 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:20.328279972 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.250664949 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:21.296919107 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.624634981 CET	55555	50004	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:21.624835014 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.624898911 CET	50004	55555	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.639352083 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:21.639467955 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.639559031 CET	50006	5651	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:21.745201111 CET	55555	50004	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:21.759752035 CET	5651	50006	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:22.266110897 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:22.312587023 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:23.282043934 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:23.328130007 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:24.297909975 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:24.343874931 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:25.313196898 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:25.359488010 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:26.328849077 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:26.375323057 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:27.344129086 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:27.390651941 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:28.344773054 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:28.390638113 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:29.360161066 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:29.406372070 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:30.375893116 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:30.421968937 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:31.391205072 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:31.437526941 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:32.407150030 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:32.453155041 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:33.175115108 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:49:33.218777895 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:49:33.422342062 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:33.468813896 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:34.000785112 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:34.001229048 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:34.001230001 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:34.168948889 CET	5651	50002	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:34.168970108 CET	465	50003	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:34.168979883 CET	8080	50005	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:34.438414097 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:34.484421015 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:35.453630924 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:35.500168085 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:36.454144955 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:36.500027895 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:37.469518900 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:37.515670061 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:38.485189915 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:38.531327963 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:39.500507116 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:39.550345898 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:40.516382933 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:40.562561989 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:40.939759970 CET	465	50003	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:40.939781904 CET	8080	50005	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:40.939851999 CET	50003	465	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:40.939871073 CET	50005	8080	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:40.948777914 CET	5651	50002	78.138.9.142	192.168.2.4
Dec 3, 2024 12:49:40.950961113 CET	50002	5651	192.168.2.4	78.138.9.142
Dec 3, 2024 12:49:41.532510042 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:41.578394890 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:42.547652006 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:42.593792915 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:43.563409090 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:43.609527111 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:44.565674067 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:44.609421015 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:45.578802109 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:45.625406027 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:46.594400883 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:46.640691042 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:47.610302925 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:47.656307936 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:48.625579119 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:48.671962976 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:49.641405106 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:49.690237999 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:50.660056114 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:50.703196049 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:51.672738075 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:51.718839884 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:52.688344955 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:52.734435081 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:53.704380035 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:53.752608061 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:54.719506979 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:54.765687943 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:55.735133886 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:55.781338930 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:56.750689983 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:56.796947956 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:57.766731024 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:57.812577009 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:58.782044888 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:58.828191996 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:49:59.797655106 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:49:59.843908072 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:00.814228058 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:00.859458923 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:01.828840971 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:01.875318050 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:02.844851971 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:02.890698910 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:03.368840933 CET	5655	49809	109.234.156.179	192.168.2.4
Dec 3, 2024 12:50:03.421957970 CET	49809	5655	192.168.2.4	109.234.156.179
Dec 3, 2024 12:50:03.860003948 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:03.906361103 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:04.860327959 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:04.906369925 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:05.883447886 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:05.937577963 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:06.891153097 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:06.937674046 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:07.891299009 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:07.937578917 CET	49873	80	192.168.2.4	111.90.147.125
Dec 3, 2024 12:50:08.907347918 CET	80	49873	111.90.147.125	192.168.2.4
Dec 3, 2024 12:50:08.953255892 CET	49873	80	192.168.2.4	111.90.147.125

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 12:47:24.735080004 CET	53809	53	192.168.2.4	1.1.1.1
Dec 3, 2024 12:47:25.149568081 CET	53	53809	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 12:47:24.735080004 CET	192.168.2.4	1.1.1.1	0xd074	Standard query (0)	id72.internetid.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.103	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.71	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.99	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.37	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.59.37	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.39	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.35	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:07.237148046 CET	1.1.1.1	192.168.2.4	0xb7f5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.102	A (IP address)	IN (0x0001)	false
Dec 3, 2024 12:47:17.780982971 CET	1.1.1.1	192.168.2.4	0x6f02	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 12:47:25.149568081 CET	1.1.1.1	192.168.2.4	0xd074	No error (0)	id72.internetid.ru	main.internetid.ru		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 12:47:25.149568081 CET	1.1.1.1	192.168.2.4	0xd074	No error (0)	main.internetid.ru		95.213.205.83	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49873	111.90.147.125	80	7796	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 12:48:18.986464024 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Dec 3, 2024 12:48:18.986479044 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Dec 3, 2024 12:48:20.628106117 CET	4	IN	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 12:48:20.628274918 CET	6	OUT	Data Raw: 00 01 12 7e Data Ascii: ~
Dec 3, 2024 12:48:20.628309965 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 3, 2024 12:48:20.628328085 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Dec 3, 2024 12:48:20.628346920 CET	6	OUT	Data Raw: 00 00 00 2e Data Ascii: .
Dec 3, 2024 12:48:20.628367901 CET	46	OUT	Data Raw: 22 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 20 00 6e 00 61 00 6d 00 65 00 3a 00 20 00 39 00 39 00 32 00 35 00 34 00 37 00 22 00 Data Ascii: "Computer name: 992547"
Dec 3, 2024 12:48:21.465563059 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:
Dec 3, 2024 12:48:22.469597101 CET	4	IN	Data Raw: 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	06:46:56
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\442.docx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\442.docx.exe"
Imagebase:	0x7ff7ed6a0000
File size:	25'141'051 bytes
MD5 hash:	FB8117B1A3F0924100FBC209DBBB1BB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:46:57
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\intel\Word.msi" /qn
Imagebase:	0x7ff6b6330000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:46:57
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6b6330000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:46:57
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\intel\Doc.docx" /o ""
Imagebase:	0x700000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:46:59
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 3A7D5E944AD6C6FD24895B2767E40451
Imagebase:	0xe60000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:47:01
Start date:	03/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:47:06
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\intel\Word.msi"
Imagebase:	0x310000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000009.00000000.1818406969.0000000000DC5000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:47:09
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Imagebase:	0x820000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000A.00000000.1856486408.0000000001CE1000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:47:14
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0x820000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:47:16
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Imagebase:	0x820000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:47:17
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Imagebase:	0x820000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000010.00000002.3578675457.0000000002B18000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000010.00000003.1936056705.0000000006601000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	06:47:18
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Imagebase:	0x310000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000011.00000002.3572801729.00000000017DA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000011.00000002.3572801729.00000000017B6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	06:47:18
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0x310000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3573808248.000000000314A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3573808248.0000000003118000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3579027400.0000000004B64000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000002.3579027400.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	06:47:26
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0x310000
File size:	11'132'168 bytes
MD5 hash:	CB9BE257064162076EBD4869CD97E166
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:48:08
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0x820000
File size:	21'764'872 bytes
MD5 hash:	D563A4D6BFCFE6884D1AC88824CB5C2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7ED6CB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6A255C: GetDlgItem.USER32 ref: 00007FF7ED6A25AC
Part of subcall function 00007FF7ED6A255C: SetWindowTextW.USER32 ref: 00007FF7ED6A25C8

EndDialog.USER32 ref: 00007FF7ED6CB2D0
SetDlgItemTextW.USER32 ref: 00007FF7ED6CB320
GetMessageW.USER32 ref: 00007FF7ED6CB350
IsDialogMessageW.USER32 ref: 00007FF7ED6CB369
TranslateMessage.USER32 ref: 00007FF7ED6CB37B
DispatchMessageW.USER32 ref: 00007FF7ED6CB389
EndDialog.USER32 ref: 00007FF7ED6CB3D3
GetDlgItem.USER32 ref: 00007FF7ED6CB410
SendMessageW.USER32 ref: 00007FF7ED6CB431
SendMessageW.USER32 ref: 00007FF7ED6CB449
SetFocus.USER32 ref: 00007FF7ED6CB452
GetLastError.KERNEL32 ref: 00007FF7ED6CB634
GetLastError.KERNEL32 ref: 00007FF7ED6CB665
GetTickCount.KERNEL32 ref: 00007FF7ED6CB68B
GetLastError.KERNEL32 ref: 00007FF7ED6CB6F5
GetCommandLineW.KERNEL32 ref: 00007FF7ED6CB841
CreateFileMappingW.KERNEL32 ref: 00007FF7ED6CB900
MapViewOfFile.KERNEL32 ref: 00007FF7ED6CB923
Sleep.KERNEL32 ref: 00007FF7ED6CB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF7ED6CB9DF
CloseHandle.KERNEL32 ref: 00007FF7ED6CB9E8
SetDlgItemTextW.USER32 ref: 00007FF7ED6CBCDE
DialogBoxParamW.USER32 ref: 00007FF7ED6CC0D7
EndDialog.USER32 ref: 00007FF7ED6CC0EF
EnableWindow.USER32 ref: 00007FF7ED6CC2A6
SendMessageW.USER32 ref: 00007FF7ED6CC2F8
ShellExecuteExW.SHELL32 ref: 00007FF7ED6CB95B

Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB67
Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB80

SendMessageW.USER32 ref: 00007FF7ED6CBEC3
SendDlgItemMessageW.USER32 ref: 00007FF7ED6CBEEA
GetDlgItem.USER32 ref: 00007FF7ED6CBEF8
SendMessageW.USER32 ref: 00007FF7ED6CBF12
GetDlgItem.USER32 ref: 00007FF7ED6CBF4F
SetDlgItemTextW.USER32 ref: 00007FF7ED6CBFEC
SetDlgItemTextW.USER32 ref: 00007FF7ED6CC004
SetDlgItemTextW.USER32 ref: 00007FF7ED6CC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CC381
SendDlgItemMessageW.USER32 ref: 00007FF7ED6CC449
EndDialog.USER32 ref: 00007FF7ED6CC463
GetDlgItem.USER32 ref: 00007FF7ED6CC491
SetFocus.USER32 ref: 00007FF7ED6CC49A
SendDlgItemMessageW.USER32 ref: 00007FF7ED6CC53E
FindFirstFileW.KERNEL32 ref: 00007FF7ED6CC562
FindClose.KERNEL32 ref: 00007FF7ED6CC68A
SendDlgItemMessageW.USER32 ref: 00007FF7ED6CC7AF

Part of subcall function 00007FF7ED6A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CCAC7

Strings

runas, xrefs: 00007FF7ED6CB7C9
%s %s, xrefs: 00007FF7ED6CC6D9, 00007FF7ED6CC946
REPLACEFILEDLG, xrefs: 00007FF7ED6CC3D3
winrarsfxmappingfile.tmp, xrefs: 00007FF7ED6CB8E0
STARTDLG, xrefs: 00007FF7ED6CB1CA
p, xrefs: 00007FF7ED6CB7AB
LICENSEDLG, xrefs: 00007FF7ED6CC0C9
@, xrefs: 00007FF7ED6CB7B6
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7ED6CB799
__tmp_rar_sfx_access_check_, xrefs: 00007FF7ED6CB6A9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 37539dee0de0f8605dc8fdad2644b0fa5e272ae0c210a86a0140fc28e7c4c48a
Instruction ID: 1fbf7a9a07d163b4291871f44faade179523296d8497987772b9b92fe0d11f37
Opcode Fuzzy Hash: 37539dee0de0f8605dc8fdad2644b0fa5e272ae0c210a86a0140fc28e7c4c48a
Instruction Fuzzy Hash: 21D29162E0C68281EA20FB25E8543B9A362EF897C4FD44133D94D476E6FE3DE554C722

Function 00007FF7ED6CCE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7ED6CD5F3
SendMessageW.USER32 ref: 00007FF7ED6CD626
SendMessageW.USER32 ref: 00007FF7ED6CD655
MoveFileW.KERNEL32 ref: 00007FF7ED6CDB4B
MoveFileExW.KERNEL32 ref: 00007FF7ED6CDB69
GetTempPathW.KERNEL32 ref: 00007FF7ED6CDC49

Part of subcall function 00007FF7ED6A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1FFB

EndDialog.USER32 ref: 00007FF7ED6CDFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6CEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6CEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6CEF73

Strings

MAX, xrefs: 00007FF7ED6CEA82, 00007FF7ED6CEA91
HIDE, xrefs: 00007FF7ED6CE9E5, 00007FF7ED6CE9F4
ProgramFilesDir, xrefs: 00007FF7ED6CD4F0
.tmp, xrefs: 00007FF7ED6CDA85
@set:user, xrefs: 00007FF7ED6CDD96, 00007FF7ED6CDDA5
MIN, xrefs: 00007FF7ED6CEAE5, 00007FF7ED6CEAF4
.lnk, xrefs: 00007FF7ED6CE406, 00007FF7ED6CE415
lnk, xrefs: 00007FF7ED6CE3CA, 00007FF7ED6CE3D9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7ED6CD501
<br>, xrefs: 00007FF7ED6CD6DA, 00007FF7ED6CD6E9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 813fa06c794cc39a0316894b44ee3bad2a4a143007a7910bb17a4a3915fa04b7
Instruction ID: fb13a167b97683cef9ba637a0fd406a2110263ecd6b0c8b218b03044dc47f2bc
Opcode Fuzzy Hash: 813fa06c794cc39a0316894b44ee3bad2a4a143007a7910bb17a4a3915fa04b7
Instruction Fuzzy Hash: 38138E62F08A8299EB10EF64D8403EC67B2EB443D8F901537DA5D17AD9EF38E594C361

Function 00007FF7ED6D0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7ED6BDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE018
Part of subcall function 00007FF7ED6BDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE030
Part of subcall function 00007FF7ED6BDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE05D

Part of subcall function 00007FF7ED6B62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7ED6B62F2
Part of subcall function 00007FF7ED6B62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7ED6B632C

Part of subcall function 00007FF7ED6C946C: OleInitialize.OLE32 ref: 00007FF7ED6C9486
Part of subcall function 00007FF7ED6C946C: SHGetMalloc.SHELL32 ref: 00007FF7ED6C94D4

GetCommandLineW.KERNEL32 ref: 00007FF7ED6D096E
OpenFileMappingW.KERNEL32 ref: 00007FF7ED6D0A07
MapViewOfFile.KERNEL32 ref: 00007FF7ED6D0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF7ED6D0A46
MapViewOfFile.KERNEL32 ref: 00007FF7ED6D0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF7ED6D0ACA
CloseHandle.KERNEL32 ref: 00007FF7ED6D0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6D0BAD
GetLocalTime.KERNEL32 ref: 00007FF7ED6D0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6D0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6D0C26
GetModuleHandleW.KERNEL32 ref: 00007FF7ED6D0C2E
LoadIconW.USER32 ref: 00007FF7ED6D0C4D
DialogBoxParamW.USER32 ref: 00007FF7ED6D0CB6
Sleep.KERNEL32 ref: 00007FF7ED6D0CE6
DeleteObject.GDI32 ref: 00007FF7ED6D0D0D
DeleteObject.GDI32 ref: 00007FF7ED6D0D1F
CloseHandle.KERNEL32 ref: 00007FF7ED6D0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D0DE3

Part of subcall function 00007FF7ED6CFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6CFD43
Part of subcall function 00007FF7ED6CFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6CFDBC

Strings

sfxname, xrefs: 00007FF7ED6D0B9B
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF7ED6D0C02
winrarsfxmappingfile.tmp, xrefs: 00007FF7ED6D09F9
STARTDLG, xrefs: 00007FF7ED6D0CA5
sfxstime, xrefs: 00007FF7ED6D0C1F

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: f9f8d21d412cc80ec5460a59123b82ae5e39a9285cdf70869c7ac79b4d5a8083
Instruction ID: 9eb25eaa1c54d15d03cf73c81508fdd66ffc8bbdf6941d4ed574175da0d08c36
Opcode Fuzzy Hash: f9f8d21d412cc80ec5460a59123b82ae5e39a9285cdf70869c7ac79b4d5a8083
Instruction Fuzzy Hash: 16127321E1CB8285EB10BB25E8553B9A362FF887C4F804633D95D47AA5FF3CE1548762

Function 00007FF7ED6BA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6BA504

Part of subcall function 00007FF7ED6C0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7ED6C0F99

SetDlgItemTextW.USER32 ref: 00007FF7ED6BA573
GetWindowRect.USER32 ref: 00007FF7ED6BA5AD
GetClientRect.USER32 ref: 00007FF7ED6BA5BB
GetWindowLongPtrW.USER32 ref: 00007FF7ED6BA66C
GetWindowRect.USER32 ref: 00007FF7ED6BA6B2
SetWindowTextW.USER32 ref: 00007FF7ED6BA6EC
GetSystemMetrics.USER32 ref: 00007FF7ED6BA6F7
GetWindow.USER32 ref: 00007FF7ED6BA708
GetWindowRect.USER32 ref: 00007FF7ED6BA746
GetWindow.USER32 ref: 00007FF7ED6BA808

Strings

CAPTION, xrefs: 00007FF7ED6BA6CF
$%s:, xrefs: 00007FF7ED6BA4EF

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: e5277c4e61114886020a4f581694e0d850e8a2c4d037cd8926021f66f1728d3d
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 8391C732B1C64186E718EF29A80476DA7A1FB887C4F945536EE4D47B98EF3CE905CB10

Function 00007FF7ED6C8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF7ED6C863D
SizeofResource.KERNEL32 ref: 00007FF7ED6C8659
LoadResource.KERNEL32 ref: 00007FF7ED6C8673
LockResource.KERNEL32 ref: 00007FF7ED6C8685
GlobalAlloc.KERNELBASE ref: 00007FF7ED6C86A6
GlobalLock.KERNEL32 ref: 00007FF7ED6C86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF7ED6C86E8
GdipAlloc.GDIPLUS ref: 00007FF7ED6C86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7ED6C8769
GlobalUnlock.KERNEL32 ref: 00007FF7ED6C878C
GlobalFree.KERNEL32 ref: 00007FF7ED6C8795

Strings

PNG, xrefs: 00007FF7ED6C862F

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: ec35344c2617e3b238bb2c928201c537f620ca5a49968f5fa37a3870cc6095d7
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: BE412125F1DB0281EE14AB16D854379E3A2AF88BD4F844436CE0D4B3A4FF7DE5489762

Function 00007FF7ED6AF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1263

Strings

__tmp_reference_source_, xrefs: 00007FF7ED6AFCCF, 00007FF7ED6AFCDE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 9bcb2e275ed03a8d7aba150d2a16dff366c135dca2d4fe69d6366dd8b3466e57
Instruction ID: 96c973a237508ddc9093c827c3029b5b724d8f22392a0ca6db3ca532f49b9613
Opcode Fuzzy Hash: 9bcb2e275ed03a8d7aba150d2a16dff366c135dca2d4fe69d6366dd8b3466e57
Instruction Fuzzy Hash: 5CE27362E0C6C292EA64EB25D1503AEE762FB857C4F804133DB9D076A5EF3CE455C722

Function 00007FF7ED6A4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A5E1C

Strings

CMT, xrefs: 00007FF7ED6A59B2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: e7d2881bcea704baf087d5cf8019b1fde48ecf371bf3b89e3d4cde4d9678f091
Instruction ID: 1480ea3995f2509eb1aa6684c5cddd05d893194bd24ffb6a2fe8c6e83ab98f06
Opcode Fuzzy Hash: e7d2881bcea704baf087d5cf8019b1fde48ecf371bf3b89e3d4cde4d9678f091
Instruction Fuzzy Hash: 1DE2C022F0C68286EB14EB65D5503FDA7A2FB453C8F840436DA9E47696EF3CE455C322

Function 00007FF7ED6B40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7ED6B410B
FindFirstFileW.KERNELBASE ref: 00007FF7ED6B415E
GetLastError.KERNEL32 ref: 00007FF7ED6B41AF
FindNextFileW.KERNEL32 ref: 00007FF7ED6B41D7
GetLastError.KERNEL32 ref: 00007FF7ED6B41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B4315

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: ee5b8a3817742aa34bf8fe6f457784b4fe5053db0f5ec5b81f22969634733f46
Instruction ID: 31beb2fc504533488b83cdebf95a66fedc3f0dc383711f377ff5eb7cc07b040e
Opcode Fuzzy Hash: ee5b8a3817742aa34bf8fe6f457784b4fe5053db0f5ec5b81f22969634733f46
Instruction Fuzzy Hash: C161B462E0C64285DA10EF29E440379A362FF957E8F905332EAAD076D9EF3CE544C711

Function 00007FF7ED6A5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF7ED6A59B2, 00007FF7ED6A675B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 359dff1c80db5b7743fdae80869b9e224ec7716eef54e7df647838bf343512b4
Instruction ID: 6c9f54b9c94fa61ba719f7831eac4edd19a5d8429cbdf6eeaed4404e8db501d4
Opcode Fuzzy Hash: 359dff1c80db5b7743fdae80869b9e224ec7716eef54e7df647838bf343512b4
Instruction Fuzzy Hash: 5C42B522F0CA8256EB18EBB4D1503FDA7A2EB51784F800137DB9E57696EF38E515C312

Function 00007FF7ED6C1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db5a9875e5f6d1f603b63d16782f803fa3cf1fd728954a44ec6c9bafca29fc1
Instruction ID: d6f06f3c458bdf98c8e39a175b450d08cf5d48467cae0aa2595b2fab67b2af08
Opcode Fuzzy Hash: 7db5a9875e5f6d1f603b63d16782f803fa3cf1fd728954a44ec6c9bafca29fc1
Instruction Fuzzy Hash: 72E1D322E0D2828AEB64EF29A0443BDB792FB547C8F854136DB4E47785EE3CF5418716

Function 00007FF7ED6C3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction ID: 1e56175946e75600b6edebb4dcddebaeabbfd0550a01950943c8dbc4b7a4af83
Opcode Fuzzy Hash: 53555d60e433f5a3dc88a335546444deb1b2c319cd0ac3813d1caa597a53afb2
Instruction Fuzzy Hash: 4CB1BFA2B09BC992DE58EB66D5087E9A392BB45BC4F848037DE0D0B751EF3CE155C312

Function 00007FF7ED6B4928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction ID: c9e60c196b9761a7b7bff42d78520d1bd0f3fd3603603bb3e2148cee6664f180
Opcode Fuzzy Hash: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction Fuzzy Hash: 9F410822F19A524AFA64FF15A94076AA253FBC47C8F844032DE0D07799EE3CF4468715

Function 00007FF7ED6BDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE05D
CreateFileW.KERNEL32 ref: 00007FF7ED6BE3F0
SetFilePointer.KERNEL32 ref: 00007FF7ED6BE40E
ReadFile.KERNEL32 ref: 00007FF7ED6BE436

Part of subcall function 00007FF7ED6BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7ED6BDDDF

CompareStringW.KERNELBASE ref: 00007FF7ED6BE559
CloseHandle.KERNEL32 ref: 00007FF7ED6BE4F3

Part of subcall function 00007FF7ED6A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1FFB

Part of subcall function 00007FF7ED6B51A4: GetVersionExW.KERNEL32 ref: 00007FF7ED6B51D5

Part of subcall function 00007FF7ED6BDFD0: LoadLibraryExW.KERNELBASE ref: 00007FF7ED6BDEFF
Part of subcall function 00007FF7ED6BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BDFB5
Part of subcall function 00007FF7ED6BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BDFBB
Part of subcall function 00007FF7ED6BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BDFC1
Part of subcall function 00007FF7ED6BDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7ED6BE7AA
ExitProcess.KERNEL32 ref: 00007FF7ED6BE7BB

Strings

peerdist.dll, xrefs: 00007FF7ED6BE38D
WindowsCodecs.dll, xrefs: 00007FF7ED6BE213
userenv.dll, xrefs: 00007FF7ED6BE15D
mpr.dll, xrefs: 00007FF7ED6BE291
usp10.dll, xrefs: 00007FF7ED6BE0DE
wintrust.dll, xrefs: 00007FF7ED6BE1B1
XmlLite.dll, xrefs: 00007FF7ED6BE339
RpcRtRemote.dll, xrefs: 00007FF7ED6BE363
ws2help.dll, xrefs: 00007FF7ED6BE10A
cabinet.dll, xrefs: 00007FF7ED6BE1DB
profapi.dll, xrefs: 00007FF7ED6BE205
ntshrui.dll, xrefs: 00007FF7ED6BE12B
propsys.dll, xrefs: 00007FF7ED6BE2AD
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF7ED6BE73B
browcli.dll, xrefs: 00007FF7ED6BE301
samlib.dll, xrefs: 00007FF7ED6BE2D7
oleaccrc.dll, xrefs: 00007FF7ED6BE1E9
shdocvw.dll, xrefs: 00007FF7ED6BE179
msasn1.dll, xrefs: 00007FF7ED6BE195
psapi.dll, xrefs: 00007FF7ED6BE115
dnsapi.DLL, xrefs: 00007FF7ED6BE259
ntmarta.dll, xrefs: 00007FF7ED6BE1F7
secur32.dll, xrefs: 00007FF7ED6BE1CD
cryptsp.dll, xrefs: 00007FF7ED6BE355
setupapi.dll, xrefs: 00007FF7ED6BE141
comres.dll, xrefs: 00007FF7ED6BE0F4
crypt32.dll, xrefs: 00007FF7ED6BE187
SetDefaultDllDirectories, xrefs: 00007FF7ED6BE053
devrtl.dll, xrefs: 00007FF7ED6BE29F
netutils.dll, xrefs: 00007FF7ED6BE283
wkscli.dll, xrefs: 00007FF7ED6BE2E5
mlang.dll, xrefs: 00007FF7ED6BE2BB
dhcpcsvc6.dll, xrefs: 00007FF7ED6BE31D
rsaenh.dll, xrefs: 00007FF7ED6BE0A7
ws2_32.dll, xrefs: 00007FF7ED6BE0FF
aclui.dll, xrefs: 00007FF7ED6BE371
apphelp.dll, xrefs: 00007FF7ED6BE14F
atl.dll, xrefs: 00007FF7ED6BE136
shell32.dll, xrefs: 00007FF7ED6BE1BF
ieframe.dll, xrefs: 00007FF7ED6BE120
imageres.dll, xrefs: 00007FF7ED6BE24B
SSPICLI.DLL, xrefs: 00007FF7ED6BE09C
dhcpcsvc.dll, xrefs: 00007FF7ED6BE32B
cryptbase.dll, xrefs: 00007FF7ED6BE0C8
DXGIDebug.dll, xrefs: 00007FF7ED6BE086, 00007FF7ED6BE5B6
SetDllDirectoryW, xrefs: 00007FF7ED6BE026
srvcli.dll, xrefs: 00007FF7ED6BE221
linkinfo.dll, xrefs: 00007FF7ED6BE347
dsrole.dll, xrefs: 00007FF7ED6BE37F
dwmapi.dll, xrefs: 00007FF7ED6BE0BD, 00007FF7ED6BE661
sfc_os.dll, xrefs: 00007FF7ED6BE091
WINNSI.DLL, xrefs: 00007FF7ED6BE275
UXTheme.dll, xrefs: 00007FF7ED6BE0B2
version.dll, xrefs: 00007FF7ED6BE07B
kernel32, xrefs: 00007FF7ED6BE011
dfscli.dll, xrefs: 00007FF7ED6BE2F3
slc.dll, xrefs: 00007FF7ED6BE23D
uxtheme.dll, xrefs: 00007FF7ED6BE66D
netapi32.dll, xrefs: 00007FF7ED6BE16B
clbcatq.dll, xrefs: 00007FF7ED6BE0E9
rasadhlp.dll, xrefs: 00007FF7ED6BE30F
iphlpapi.DLL, xrefs: 00007FF7ED6BE267
cryptui.dll, xrefs: 00007FF7ED6BE1A3
cscapi.dll, xrefs: 00007FF7ED6BE22F
samcli.dll, xrefs: 00007FF7ED6BE2C9
lpk.dll, xrefs: 00007FF7ED6BE0D3

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction ID: 0f11d5860616e8b06ff2e93d6f164c05ea15ca0f3898405829cf5f0eb43f0f93
Opcode Fuzzy Hash: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction Fuzzy Hash: 2532E731E0DB8299EB11AB60E8402E9B3A6FF48394F900237DA8D477A5FF39D255C751

Function 00007FF7ED6B98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6B8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6B9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6BA435

Part of subcall function 00007FF7ED6C0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7ED6C0B44), ref: 00007FF7ED6C0BE9

Strings

*messages***, xrefs: 00007FF7ED6B9BC6
RTL, xrefs: 00007FF7ED6B9F2E
,, xrefs: 00007FF7ED6B9FAA
DIRECTION, xrefs: 00007FF7ED6B9DE5
@%s:, xrefs: 00007FF7ED6B9F57
DIALOG, xrefs: 00007FF7ED6B9DCD
*messages***, xrefs: 00007FF7ED6B9C04
STRINGS, xrefs: 00007FF7ED6B9DC1
$%s:, xrefs: 00007FF7ED6B9F50
MENU, xrefs: 00007FF7ED6B9DD9
, xrefs: 00007FF7ED6B9DF9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: fbb6bb3726090cda1910aaae614b465107cbfe89c1b50f7df837cda548b3fcd6
Instruction ID: ecbd0fa666c52fd5f520d89bc54eb2dc39cb352e27e7c3fd12538dd210852e8d
Opcode Fuzzy Hash: fbb6bb3726090cda1910aaae614b465107cbfe89c1b50f7df837cda548b3fcd6
Instruction Fuzzy Hash: 31629922E1DA8285EB20EB24D4483BDA362FB547C8FC05133DA4E47695FF79E945C362

Function 00007FF7ED6D1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7ED6D1558: DloadProtectSection.DELAYIMP ref: 00007FF7ED6D15C9

RaiseException.KERNEL32 ref: 00007FF7ED6D19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7ED6D1993

Part of subcall function 00007FF7ED6D1868: DloadProtectSection.DELAYIMP ref: 00007FF7ED6D18C7

LoadLibraryExA.KERNELBASE ref: 00007FF7ED6D1A46
GetLastError.KERNEL32 ref: 00007FF7ED6D1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7ED6D1A86
RaiseException.KERNEL32 ref: 00007FF7ED6D1A9A

Strings

H, xrefs: 00007FF7ED6D1974

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 27a36b8aca31f6652ae203982c53a0a66afaf0aa395b8daadcc0e433622f97e7
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: D7915C32F09B128AEB40EF65E8507A8A3B2BB08B94B844436DE0D17794FF7CE555C361

Function 00007FF7ED6CF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF7ED6CF747
ShowWindow.USER32 ref: 00007FF7ED6CF786
GetExitCodeProcess.KERNEL32 ref: 00007FF7ED6CF7BD
CloseHandle.KERNEL32 ref: 00007FF7ED6CF7E7
ShowWindow.USER32 ref: 00007FF7ED6CF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CF8FB

Strings

.inf, xrefs: 00007FF7ED6CF675
Install, xrefs: 00007FF7ED6CF684
p, xrefs: 00007FF7ED6CF529
.exe, xrefs: 00007FF7ED6CF7F2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: 6e56b012281178d840e256ad45ed2bf74d7a60ef72c69255f0e18c76dd578e91
Instruction ID: 9001cb94a2918d88606d840e80cdd50b2147ee5bbfb0861cd6ad8a5d619b1b4f
Opcode Fuzzy Hash: 6e56b012281178d840e256ad45ed2bf74d7a60ef72c69255f0e18c76dd578e91
Instruction Fuzzy Hash: CDC18E22F1E60295FA10EB25D950379A7B2AF98BC4F844033DA4D477A5FF3CE4658362

Function 00007FF7ED6CF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7ED6CAE1C: PeekMessageW.USER32 ref: 00007FF7ED6CAE32
Part of subcall function 00007FF7ED6CAE1C: GetMessageW.USER32 ref: 00007FF7ED6CAE49
Part of subcall function 00007FF7ED6CAE1C: IsDialogMessageW.USER32 ref: 00007FF7ED6CAE60
Part of subcall function 00007FF7ED6CAE1C: TranslateMessage.USER32 ref: 00007FF7ED6CAE6F
Part of subcall function 00007FF7ED6CAE1C: DispatchMessageW.USER32 ref: 00007FF7ED6CAE7A

GetDlgItem.USER32 ref: 00007FF7ED6CF0E3
ShowWindow.USER32 ref: 00007FF7ED6CF109
SendMessageW.USER32 ref: 00007FF7ED6CF11E
SendMessageW.USER32 ref: 00007FF7ED6CF136
SendMessageW.USER32 ref: 00007FF7ED6CF157
SendMessageW.USER32 ref: 00007FF7ED6CF173
SendMessageW.USER32 ref: 00007FF7ED6CF1B6
SendMessageW.USER32 ref: 00007FF7ED6CF1D4
SendMessageW.USER32 ref: 00007FF7ED6CF1E8
SendMessageW.USER32 ref: 00007FF7ED6CF212
SendMessageW.USER32 ref: 00007FF7ED6CF22A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: be12a2335c8822ec684860299e569b22e29185e90977e71bcbb16c340554c13a
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: C241ED31F18A4286F304EF61EC10BAEA761EB89BCCF840136DD0A07B95DE3DE4598765

Function 00007FF7ED6AEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF572

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 62b60af2f7a88576df12e3db194ad19acd1e3759869934ce613b8f4ca490e85a
Instruction ID: cf3b730a379a3729956ec7fb8ee6ee5159c6ff52010081db963a879decd7023e
Opcode Fuzzy Hash: 62b60af2f7a88576df12e3db194ad19acd1e3759869934ce613b8f4ca490e85a
Instruction Fuzzy Hash: C8129062F0C74285EB10EB65D4543ADA372EB457E8F800232EA9D17ADAEF3CD585C352

Function 00007FF7ED6B24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7ED6B259B
GetLastError.KERNEL32 ref: 00007FF7ED6B25AE
CreateFileW.KERNEL32 ref: 00007FF7ED6B260E
GetLastError.KERNEL32 ref: 00007FF7ED6B2617
SetFileTime.KERNEL32 ref: 00007FF7ED6B26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B2736

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: dc46ff84bd0c57c9ac2b9914d0228e8f14f7433d989622a2074281460ea8d587
Instruction ID: c878f6e81967effb608826bbab9ad56d476fffd6ffacd624a692f693288010a2
Opcode Fuzzy Hash: dc46ff84bd0c57c9ac2b9914d0228e8f14f7433d989622a2074281460ea8d587
Instruction Fuzzy Hash: CC61F462E1C64186E7209B29E50036EA7B2FB887E8F501336DFAD07AD8EF3DD0558715

Function 00007FF7ED6CB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF7ED6CB02A
GetObjectW.GDI32 ref: 00007FF7ED6CB05B
DeleteObject.GDI32 ref: 00007FF7ED6CB095
DeleteObject.GDI32 ref: 00007FF7ED6CB0C5

Part of subcall function 00007FF7ED6C8624: FindResourceExW.KERNELBASE ref: 00007FF7ED6C863D
Part of subcall function 00007FF7ED6C8624: SizeofResource.KERNEL32 ref: 00007FF7ED6C8659
Part of subcall function 00007FF7ED6C8624: LoadResource.KERNEL32 ref: 00007FF7ED6C8673
Part of subcall function 00007FF7ED6C8624: LockResource.KERNEL32 ref: 00007FF7ED6C8685
Part of subcall function 00007FF7ED6C8624: GlobalAlloc.KERNELBASE ref: 00007FF7ED6C86A6
Part of subcall function 00007FF7ED6C8624: GlobalLock.KERNEL32 ref: 00007FF7ED6C86BB
Part of subcall function 00007FF7ED6C8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF7ED6C86E8
Part of subcall function 00007FF7ED6C8624: GdipAlloc.GDIPLUS ref: 00007FF7ED6C86FE
Part of subcall function 00007FF7ED6C8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7ED6C8769
Part of subcall function 00007FF7ED6C8624: GlobalUnlock.KERNEL32 ref: 00007FF7ED6C878C
Part of subcall function 00007FF7ED6C8624: GlobalFree.KERNEL32 ref: 00007FF7ED6C8795

Strings

], xrefs: 00007FF7ED6CB063

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: dd3f02435733672b3a7be9accea847423a14611fea65da1771c88656bc3d2f3f
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 82116321F0D64241FA64BB25A654379D393AF88BC4F984036D95D0BB96FE3CE8148722

Function 00007FF7ED6CAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7ED6CAE32
GetMessageW.USER32 ref: 00007FF7ED6CAE49
IsDialogMessageW.USER32 ref: 00007FF7ED6CAE60
TranslateMessage.USER32 ref: 00007FF7ED6CAE6F
DispatchMessageW.USER32 ref: 00007FF7ED6CAE7A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 1ea3a426cdbe6561ddc7a00d063cafe43a719aebf67a826517bd8a6de7ad9d01
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 7AF0EC25E3C55282FB50AB24EC95B3AA361BF98789FC05432E64E43894EF3CD518CB11

Function 00007FF7ED6C91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF7ED6C9211
SHAutoComplete.SHLWAPI ref: 00007FF7ED6C9255

Part of subcall function 00007FF7ED6C13C4: CompareStringW.KERNEL32 ref: 00007FF7ED6C13E3

FindWindowExW.USER32 ref: 00007FF7ED6C923F

Strings

EDIT, xrefs: 00007FF7ED6C921B, 00007FF7ED6C9233

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 4436c80657fb65d8c5de147d020370cce5cbf848b088d91f852913b281f25305
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: AC01FB61E1CA4281FA20AB21A8207B6A392AF9C7C9FC41133C94D47695FE3CE1598661

Function 00007FF7ED6B2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF7ED6B8C9A), ref: 00007FF7ED6B2D22
WriteFile.KERNEL32 ref: 00007FF7ED6B2D6C
WriteFile.KERNELBASE ref: 00007FF7ED6B2D9A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 759593f06e971a5af3dff942057e3884964648b854c35b3f90eb8150d1d2c130
Instruction ID: 586d73c8bfe66b5e05a1955af9864445f2715e14183da63d5bedeeecc9d48181
Opcode Fuzzy Hash: 759593f06e971a5af3dff942057e3884964648b854c35b3f90eb8150d1d2c130
Instruction Fuzzy Hash: AE510822E1D54242EB50EB25D54477AA362FF89BD4F840133EA4D476D4EF3CD585C322

Function 00007FF7ED6D03E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF7ED6D0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D05CD

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: f6b19c5786641239495edb38a692ba8cfa3517dae24bead12263da06daead65f
Instruction ID: 2dcbb4f4d9bf76fe4b65f83b8344356deeda4129e33f9b23ede79c400cafd500
Opcode Fuzzy Hash: f6b19c5786641239495edb38a692ba8cfa3517dae24bead12263da06daead65f
Instruction Fuzzy Hash: 06518162F1C65284FF00BBA5E8553ADA323AB457D4F900636DE1C1B6D6EE7CD450C362

Function 00007FF7ED6B3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF7ED6B309D), ref: 00007FF7ED6B36CE
CreateDirectoryW.KERNEL32 ref: 00007FF7ED6B3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7ED6B309D), ref: 00007FF7ED6B3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B37CE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 5cda4ea00785afd89f4b2a0283e369f756aeb3863be6a65230e4b36aaec5c4cf
Instruction ID: 2055f750cc0f37e0d6e23525459d6f54209e3a946174940bfba47dbd91232343
Opcode Fuzzy Hash: 5cda4ea00785afd89f4b2a0283e369f756aeb3863be6a65230e4b36aaec5c4cf
Instruction Fuzzy Hash: E031A262F1CA4281EA20BB25A454379E353FF887D0FD00232EE9D476A5FF3CD4458626

Function 00007FF7ED6D2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7ED6D2D7B

Part of subcall function 00007FF7ED6D27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7ED6D281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7ED6D2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF7ED6D2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7ED6D2E51

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: c40745e2af1d3799910518bad8e8a2b746ab528b383ea8d81b670bf5645d7bd4
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 1E313D10E0C20345EA54BB65B5313BA92935F893C4FC60437D90E4B2E7FE3DA5288273

Function 00007FF7ED6B2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF7ED6B2927,?,00100000,?,00000001,00000000,00000000,?,00007FF7ED6B14C1), ref: 00007FF7ED6B2348
ReadFile.KERNELBASE ref: 00007FF7ED6B2367
GetLastError.KERNEL32 ref: 00007FF7ED6B239B
GetLastError.KERNEL32 ref: 00007FF7ED6B23BA

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 27948f418b380cd68232c2aa8a70ddb54f9bbc8f9f5d767db1e362d6fccebe87
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: A521C221E0C61281EA20AF11A60033DE3E2FF89BD4F944532DA4D4F684EF7DD9858723

Function 00007FF7ED6BE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6BECD8: ResetEvent.KERNEL32 ref: 00007FF7ED6BECF1
Part of subcall function 00007FF7ED6BECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF7ED6BED07

ReleaseSemaphore.KERNEL32 ref: 00007FF7ED6BE974
CloseHandle.KERNELBASE ref: 00007FF7ED6BE993
DeleteCriticalSection.KERNEL32 ref: 00007FF7ED6BE9AA
CloseHandle.KERNEL32 ref: 00007FF7ED6BE9B7

Part of subcall function 00007FF7ED6BEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7ED6BE95F,?,?,?,00007FF7ED6B463A,?,?,?), ref: 00007FF7ED6BEA63
Part of subcall function 00007FF7ED6BEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7ED6BE95F,?,?,?,00007FF7ED6B463A,?,?,?), ref: 00007FF7ED6BEA6E

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 5a7d86e612901bf4b4845faa66de3de72b61dd51cab201e4976645d81ff60667
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: FE012D32E18A8192E648EB21E5447ADB322FBC8BC0F404032DB6D57665DF39E5B48751

Function 00007FF7ED6BEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF7ED6BEAE0
SetThreadPriority.KERNEL32 ref: 00007FF7ED6BEB36

Strings

CreateThread failed, xrefs: 00007FF7ED6BEAEE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: e5d2293a1847ffdba220fd5866fbf571c872fa41c6d6f032e167c684c78122b9
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: E7115B31E1CA4281E714AB14E8413A9F362FB887D8F944137DA8E43669FF7CE595CB21

Function 00007FF7ED6C946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7ED6BDDDF

OleInitialize.OLE32 ref: 00007FF7ED6C9486
SHGetMalloc.SHELL32 ref: 00007FF7ED6C94D4

Strings

riched20.dll, xrefs: 00007FF7ED6C9475

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: f6fb138ae7a015bb45632dc76dd97c84c2c7e380e1545a9537b4e377dae4ebd4
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: CEF03171A1CA4182E700AF20F81426EF7A0FB88798F804136E98D47694EF7CD159CB11

Function 00007FF7ED6C095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6C853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7ED6C856C

Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB67
Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB80

Part of subcall function 00007FF7ED6A1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1FFB

Part of subcall function 00007FF7ED6A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6D01C1
SendDlgItemMessageW.USER32 ref: 00007FF7ED6D01F2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: f7a8a175be1daf3eca109b687688224756fee905e724f508e14b940bc333b7d5
Instruction ID: c986d88292786a879319b34445fcbef49a8f725b3c1417bd9aff353e99d3be55
Opcode Fuzzy Hash: f7a8a175be1daf3eca109b687688224756fee905e724f508e14b940bc333b7d5
Instruction Fuzzy Hash: 4A51D162F0864256EB10BBA1E8553FDA323AB89BC4F800537DE0D5B7DAEE3CD5108361

Function 00007FF7ED6A1744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A18A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7ED6A18D4

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: be886d0b0dd0ab9ec10d8091ff35c207a3a05e000928f8ccd12ad683e5eeb367
Instruction ID: 42630643fb1ae70b0325daae142393da8438f710c7a9f4f8317e74b267f263eb
Opcode Fuzzy Hash: be886d0b0dd0ab9ec10d8091ff35c207a3a05e000928f8ccd12ad683e5eeb367
Instruction Fuzzy Hash: 7041C161F1C64585EA04EB12E544379E366EB08BE0F944A32DEBD0BBD5EF7CE0918315

Function 00007FF7ED6B2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7ED6B21CF
CreateFileW.KERNEL32 ref: 00007FF7ED6B223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B22D8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 650906bb36444c59f78769edd7e70a31dc34f49dc41decdeb4024168be9b1e6b
Instruction ID: 6ff497486b5f0054a1bd8855e7d9152f180c8e950744e99eba3eab8843cb33af
Opcode Fuzzy Hash: 650906bb36444c59f78769edd7e70a31dc34f49dc41decdeb4024168be9b1e6b
Instruction Fuzzy Hash: 3641C372E0C68182EB10EB15E544369A3A2FB897F4F905336DFAD07AD5EF3CD4908611

Function 00007FF7ED6A23F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7ED6A243E
GetWindowTextW.USER32 ref: 00007FF7ED6A2476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A2505

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 1bf85210b9a87779fb11811f9a7e2f8ba75c636e64e4f9da94f36f1c7ff0fb34
Instruction ID: 3fe131051ff8ebf3cdd13c5ac01f05dcd6864df97c1ed411e14956378da2f6d5
Opcode Fuzzy Hash: 1bf85210b9a87779fb11811f9a7e2f8ba75c636e64e4f9da94f36f1c7ff0fb34
Instruction Fuzzy Hash: A821B162E1CB8181EA10AB25F94027AA361FB8DBD0F945232EBDD03B95EF3CD1908701

Function 00007FF7ED6C1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6C205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6C2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6C2093

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 65d8091f10f06cce83768fe095ce433e052fa83f4fe25a8c85fad3cbd40ccd0d
Instruction ID: 7d423d33bcd81083ada17a52cde6813d8394848f27dc4e9ac958f13788abd1d8
Opcode Fuzzy Hash: 65d8091f10f06cce83768fe095ce433e052fa83f4fe25a8c85fad3cbd40ccd0d
Instruction Fuzzy Hash: 9C317E52E0DA8651EA24BB14E5443B9A3A2FB94BC4F944033D68C076A9EF7CE956C313

Function 00007FF7ED6B3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF7ED6C07E1), ref: 00007FF7ED6B3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF7ED6B3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B3E1A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 30421b436104fcb90b4cd2208b99a3bf3782908f0837f7a91d3eb4cb73bf7196
Instruction ID: bf0de4ae827cdbf1a781777bdb737e4009fc0e2c6f83dff6e4fd32c277958469
Opcode Fuzzy Hash: 30421b436104fcb90b4cd2208b99a3bf3782908f0837f7a91d3eb4cb73bf7196
Instruction Fuzzy Hash: C621FB22F0CA8141EA20AF25F455369A362FFC87D4F904232EE9D476A5FF3DD544C611

Function 00007FF7ED6B31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF7ED6C0822), ref: 00007FF7ED6B31E7
DeleteFileW.KERNEL32 ref: 00007FF7ED6B3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B32A1

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 539e2a0488ada646b9a4eb5c90a9f278ffd13936dc8dbc7caf4118334a65d282
Instruction ID: acb3b6a2a0b3b03adfa2e2229abc7593097926f83f8af555682f1fe7ad9507a4
Opcode Fuzzy Hash: 539e2a0488ada646b9a4eb5c90a9f278ffd13936dc8dbc7caf4118334a65d282
Instruction Fuzzy Hash: 7821A722F1C78181EA10EB25F45436EA362FF88BD4F901232EA9D47AA5EF3CD540C611

Function 00007FF7ED6B32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF7ED6BE5B1,?,?,?,00000000,?), ref: 00007FF7ED6B32E7
GetFileAttributesW.KERNELBASE ref: 00007FF7ED6B3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B3399

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: a8bcf6e2598255fa991570dfaf367ef52c8767d47326b3423635884fafe6ecbe
Instruction ID: fa8ff61be83dc4f499d54906ba5c2d8122729c229afb9689ab69771e71cd1f23
Opcode Fuzzy Hash: a8bcf6e2598255fa991570dfaf367ef52c8767d47326b3423635884fafe6ecbe
Instruction Fuzzy Hash: 99214762E1C78181EA10EB29F45532AA362FBC97E4F900232EA9D477E5EF3CD541C615

Function 00007FF7ED6DBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7ED6DBF48), ref: 00007FF7ED6DBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF7ED6DBF48), ref: 00007FF7ED6DBF97
ExitProcess.KERNEL32 ref: 00007FF7ED6DBFA6

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: e504c79c2d254bc3d4ba1e62ef166d79919cfcda22392fb8b057ec2dd054d275
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 57E01214E0C70546EA547F65686537953635F887C1F50443DCC0E4739AED3DA8194622

Function 00007FF7ED6AF578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AF89B

Part of subcall function 00007FF7ED6B3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7ED6C0811), ref: 00007FF7ED6B3EFD

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 9a071fa467f85a34a6f05ca9243d790f6abafaa5b1570881c384a2819231f8c8
Instruction ID: 2bf4e0fb1ece5bd8057a21f4f77a5349bbaadd342d75236abe7b2b5a675399d1
Opcode Fuzzy Hash: 9a071fa467f85a34a6f05ca9243d790f6abafaa5b1570881c384a2819231f8c8
Instruction Fuzzy Hash: 18917172E1C68194EB10EB64E4443ADA762FB447D8FD04236FA9C07AE9EF78D545C312

Function 00007FF7ED6A3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A3AB9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 64605ea4c96cd6a261f561e4281ee818068104f0c146ac1253270dcee5fc1f01
Instruction ID: 3f166eba91255d9527d9f94a2e7fed95befd7d854273c85cae0601ef6b0830a1
Opcode Fuzzy Hash: 64605ea4c96cd6a261f561e4281ee818068104f0c146ac1253270dcee5fc1f01
Instruction Fuzzy Hash: D041B462F1C65184FB00FBB5D4503EDA362AF44BD8F945136EE5D27AEAEE38D4828311

Function 00007FF7ED6B2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF7ED6B274D), ref: 00007FF7ED6B28A9
GetLastError.KERNEL32(?,00007FF7ED6B274D), ref: 00007FF7ED6B28B8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 8655ed0b1a5ad6605738716637f65aff99ff732a6250fc80ba42a03d96ae9b4d
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: D231E722F1DD4282EA606B2ADA4077DA392AF48BD4F940132DE1D577A4FE3CD5458262

Function 00007FF7ED6A22BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7ED6A22F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A23F0

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 95739ad7301a08b82252912ada3ab6f57aee1bff7a48893d1edd4817af44debc
Instruction ID: fbecd5501b7a89a7913c50216763c35c990c2dcab06bc32832f5059e097b7c7b
Opcode Fuzzy Hash: 95739ad7301a08b82252912ada3ab6f57aee1bff7a48893d1edd4817af44debc
Instruction Fuzzy Hash: 8831B022E1C78182EA10AB15F55436AF362EB89BD0F805232EA9D0BBD5EF3CE1508711

Function 00007FF7ED6B2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF7ED6B2AFE
SetFileTime.KERNELBASE ref: 00007FF7ED6B2B9B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 835e56aa05b1dc6710e760b4f1d018a4d3fd56163fb322f891e562754766dc5b
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: D7213662F0DB4259EA62AF11D6003BAD7D2AF097D8F944032DE4C07291FE3CD586CB12

Function 00007FF7ED6BAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7ED6BAB67
LoadStringW.USER32 ref: 00007FF7ED6BAB80

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 9b2b2ddb43924b328f66bceea46309551bf297a356838e29d39f9cacc79348fd
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 27119070F0CA0185EA00AF16AC44268F7A2BB88FD8F94443ACE1D93760EF7CE5918755

Function 00007FF7ED6B2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF7ED6B2C11
GetLastError.KERNEL32 ref: 00007FF7ED6B2C1E

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 4634e17f8a1fbfbd9a743e06b7fea2f7b9185d31b0a2df0689cef8b4ce37684d
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 0A11AE21E1C64181EB60AB25E940379A3A1FB49BF8F940732DA7D572D4EF3CE582C312

Function 00007FF7ED6A255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6BA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6BA504
Part of subcall function 00007FF7ED6BA4AC: SetDlgItemTextW.USER32 ref: 00007FF7ED6BA573
Part of subcall function 00007FF7ED6BA4AC: GetWindowRect.USER32 ref: 00007FF7ED6BA5AD
Part of subcall function 00007FF7ED6BA4AC: GetClientRect.USER32 ref: 00007FF7ED6BA5BB

GetDlgItem.USER32 ref: 00007FF7ED6A25AC
SetWindowTextW.USER32 ref: 00007FF7ED6A25C8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 8bb57ff74ddf2d07363972b4c16f0d07a27369ef17d38cbfbb36234324941678
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 80015E20E0D64A41FE59B792A558379D7936F897C8F881036C88D072D9FE7CE8848322

Function 00007FF7ED6BEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7ED6BEBAD,?,?,?,?,00007FF7ED6B5752,?,?,?,00007FF7ED6B56DE), ref: 00007FF7ED6BEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF7ED6BEB6F

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 2242999942cc360ee701a129ebad3759532c7951f8e543f71efb0edcb71bd916
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: A0E0E561F1854642DB089B55C4406E9A393BFC8B80BC48036D60B83615EE3DE2458B01

Function 00007FF7ED6D21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6D2200

Part of subcall function 00007FF7ED6D2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6D2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6D2206

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction ID: 4f121f32547bc059bd16649d191eeb8f9c3286c304e378de6414727e420f431b
Opcode Fuzzy Hash: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction Fuzzy Hash: D5E0B640E4D10741F91872662E363B581520F6D3F0EDD5B32DA7E076C6BD3CA4B58172

Function 00007FF7ED6DD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF7ED6DD922
GetLastError.KERNEL32 ref: 00007FF7ED6DD934

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: e2172a6a6c390398a828f8f98e4c04b79420647527ec3a2a7c44eb1e2e9a9319
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: A2E04F50E0D20382FF04BFB2681537493925FEC790F842032C90DCB252FF3D95A18A22

Function 00007FF7ED6A33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A388C

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8948bb9802c6c0987d886fae829bf96634841c4c74bd64b8e97cfea881f89bd5
Instruction ID: 4d2dffc6a0976713cc7f2065be6d652ddda47e382e20a2e03d512ca8b1de8f50
Opcode Fuzzy Hash: 8948bb9802c6c0987d886fae829bf96634841c4c74bd64b8e97cfea881f89bd5
Instruction Fuzzy Hash: F9D1B962F0C68156EB68AB6595403B8E7A2FB45BC4F844037CB9D477B1EF38F4648322

Function 00007FF7ED6B5294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B551B

Part of subcall function 00007FF7ED6C13F4: CompareStringW.KERNEL32 ref: 00007FF7ED6C145A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: 60054bf23714923d6cf658706c57d8570bb270d346a0b8b9a17da1f048c8cd6a
Instruction ID: 4fc506c1c1b61142efeaeeb6d186f79016a92b76ef7b070f7b27839d60cf1061
Opcode Fuzzy Hash: 60054bf23714923d6cf658706c57d8570bb270d346a0b8b9a17da1f048c8cd6a
Instruction Fuzzy Hash: 3B61A021E1C64781FA64BA2995143FAD293AF45BD8F944533EE4E07BC5FE7CE8418223

Function 00007FF7ED6C1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6BE948: ReleaseSemaphore.KERNEL32 ref: 00007FF7ED6BE974
Part of subcall function 00007FF7ED6BE948: CloseHandle.KERNELBASE ref: 00007FF7ED6BE993
Part of subcall function 00007FF7ED6BE948: DeleteCriticalSection.KERNEL32 ref: 00007FF7ED6BE9AA
Part of subcall function 00007FF7ED6BE948: CloseHandle.KERNEL32 ref: 00007FF7ED6BE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C1ACB

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 7dd4c45c898d1fc3c125baa466fe89dc4e149350440c7c1a3107608e29ab7dcf
Instruction ID: 3c3487f94e68efce25aa539d7c13b3655f8bde90fb5de0a52dcdb22729c77a0d
Opcode Fuzzy Hash: 7dd4c45c898d1fc3c125baa466fe89dc4e149350440c7c1a3107608e29ab7dcf
Instruction Fuzzy Hash: E3618062F1968596EE08EB66D5642BCB366FB40BD0B944133E72D07AC5EF3CE4718311

Function 00007FF7ED6AEC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AEEB8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2f83e6df9ab7224275e60499f17cd5cc3bb417b2ed89fe698c193226d29eb46c
Instruction ID: d2d09615f0864f7edcc77686437b03e1d5788a80f843494a0ebb99bd5db3d242
Opcode Fuzzy Hash: 2f83e6df9ab7224275e60499f17cd5cc3bb417b2ed89fe698c193226d29eb46c
Instruction Fuzzy Hash: 3D51B262F0C68250EA14BB25A4443ADA752FB85BC4F844137EE9D07397EE3DE895C361

Function 00007FF7ED6AE7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7ED6C0811), ref: 00007FF7ED6B3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AE993

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 7ccb79097edba5c9ff264a6ea3acda2e11d4279ec26602cbe1bb149cda34522a
Instruction ID: 85fc181c984cdd6654236c0b360cbb6b6c028ef25b5c6493e65dc00d74d8a229
Opcode Fuzzy Hash: 7ccb79097edba5c9ff264a6ea3acda2e11d4279ec26602cbe1bb149cda34522a
Instruction Fuzzy Hash: 63515E22F1C68681FB60AB25D44536DA362FB94BC4F940137EA9D0B6A6EF3CD441C762

Function 00007FF7ED6B1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B187D

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 35ea3b04d8214deea48c115844c26589502cb7cbcbac9db44318e90ece9789cf
Instruction ID: 09c2e6b1dad3f19e7111ea0195526d122a15a6e2a69cde724bc6d7fdb7150eb3
Opcode Fuzzy Hash: 35ea3b04d8214deea48c115844c26589502cb7cbcbac9db44318e90ece9789cf
Instruction Fuzzy Hash: 1541D762F1CA9151EA14AB17A644379E362FB84BC0F848537EE5C4BF9AEF3CD4518300

Function 00007FF7ED6B2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B30C8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 79c0921cd87fe934e762e48f5845e8be846b4b6500caa7e1addc831544741880
Instruction ID: e9fa7212ce83f71702394bb4be6e7351fcdee26ba0d57cb7fc3c79094941c121
Opcode Fuzzy Hash: 79c0921cd87fe934e762e48f5845e8be846b4b6500caa7e1addc831544741880
Instruction Fuzzy Hash: 4C41E862F0CB0580EE10BF15E545379A3A2EF45BD4F941136EA8D077E9EF3DE4808661

Function 00007FF7ED6DBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7ED6DBE20

Part of subcall function 00007FF7ED6DBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF7ED6DBFD0
Part of subcall function 00007FF7ED6DBFB0: GetProcAddress.KERNEL32 ref: 00007FF7ED6DBFE6
Part of subcall function 00007FF7ED6DBFB0: FreeLibrary.KERNEL32 ref: 00007FF7ED6DC00B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 591beeabd835e50e3eb22a93bd4c49ec1e3270a0117c15319aedc594d4d1e563
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 7A41A411E1C64286FA14BB19E860378A362AF98BC4FC44437DA0D4B6D5FE7DE85087A3

Function 00007FF7ED6A129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A1396

Part of subcall function 00007FF7ED6A1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6A1F89

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction ID: dae8304449e0ef768d5f6695f4e456134ea9896c2d362d57995762dfd854cfb0
Opcode Fuzzy Hash: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction Fuzzy Hash: 9E218122E0C65185EA14AF52A510379A261EB04BF0FA80B32DFBE47BD1EE7CE0518356

Function 00007FF7ED6E124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6E1280

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 1b362d166deadb533d11c156eb13a9daa35a48e6541c472aa3353cdeacbc80b0
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 36115C21D1C6828AE610FB50E850739A2A6BB483C4F950136EA4DC76D6EF3DEA509763

Function 00007FF7ED6A3AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A3B6C

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 454a1fcff6e1850c8b97cdd7684a735fd34d2cefc8bc4c1965818da2daadb151
Instruction ID: 39d5d5d85011646ca4345cdea346cba3059876283f997bcb8084897204c69a24
Opcode Fuzzy Hash: 454a1fcff6e1850c8b97cdd7684a735fd34d2cefc8bc4c1965818da2daadb151
Instruction Fuzzy Hash: 8701A562E1C68541EA11B768E441369B363FB997D0FC05233E6DD0B6A5EF7CD0408715

Function 00007FF7ED6D1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6D1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF7ED6D1573,?,?,?,00007FF7ED6D192A), ref: 00007FF7ED6D162B

DloadProtectSection.DELAYIMP ref: 00007FF7ED6D15C9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: 2884e6b47b335cf623f57503e23109ddf411cc4ec78ebe998340e256a5b01a01
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: E211ACA0D0C94781FB50BB05A8613709362AF5838CF981037D90D4B2E1FEFCA5A58662

Function 00007FF7ED6B3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B40BC: FindFirstFileW.KERNELBASE ref: 00007FF7ED6B410B
Part of subcall function 00007FF7ED6B40BC: FindFirstFileW.KERNELBASE ref: 00007FF7ED6B415E
Part of subcall function 00007FF7ED6B40BC: GetLastError.KERNEL32 ref: 00007FF7ED6B41AF

FindClose.KERNELBASE(?,?,00000000,00007FF7ED6C0811), ref: 00007FF7ED6B3EFD

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: b6f63129f3851c03fac35c275ff44dd03a37d2f439993decff0e63442f52496e
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 01F0A462E0C28185DA10BB75A500379B7629F19BF4F541336EA3D073E7DE38D4448766

Function 00007FF7ED6B273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF7ED6B2755

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: 2d8ff7be4b491cf40c5af5847d0026af32347a81eac15a6152d958f244c1e86e
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: 2CE0C212F2891582EF20BB3AC8427389362EF8CFC4B881072CE0C4B331DE39C5858A55

Function 00007FF7ED6B2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7ED6B24A2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 71be5955b34736f85ca18068078efe1c65dc45a771b5b1c2de06fb33f06f5e2e
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: A9D02212D0D40082DE00B335D84123C6381AF8B374FE00332C63EC3AE1CE3E9086A322

Function 00007FF7ED6B7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF7ED6B7FD2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: d2546429bc34374496d242ec72c37ed25424fdafe4049530811da3707a9dfe1b
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 5DC08C20F09602C1DA08AB26C8C921813AABB94B44BB04036C50CC6120EE3DC6EA939E

Function 00007FF7ED6DFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7ED6DFA59

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 7d54f6910ef233da067c458b075c49b02bc9d010933ed1f216a8c45d0c1d12bc
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 58F04F51F0D64785FE547765A9213B592925FC8BC8F8C5432C90D8B3C1FE3CA6A14172

Function 00007FF7ED6B20D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF7ED6B207E), ref: 00007FF7ED6B20F6

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: d6dd4ffc1033350c7307e5db1f63b1b013b7c426f1ffe17994fe5c6cf96f92ba
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 8EF0A921E0C58245FB249B20D541379A7A2DB18BF8F885336D73D061D4EF38D8A58321

Function 00007FF7ED6DD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7ED6DD98A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: c596aacec03dea458927b363e08bf93b57b054301cb31242f344f9faef831f80
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 74F03A11E0D34644FF547AB168203B592925F987E0F887632D96E8B2C1FF3EA4608932

Non-executed Functions

Function 00007FF7ED6AC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6ADE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7ED6ACF4B), ref: 00007FF7ED6ADE27
Part of subcall function 00007FF7ED6ADE04: GetLastError.KERNEL32 ref: 00007FF7ED6ADE88
Part of subcall function 00007FF7ED6ADE04: CloseHandle.KERNEL32 ref: 00007FF7ED6ADE9B

wcscpy.LIBCMT ref: 00007FF7ED6ACBC8
wcscpy.LIBCMT ref: 00007FF7ED6ACBFE
CreateFileW.KERNEL32 ref: 00007FF7ED6ACC38
DeviceIoControl.KERNEL32 ref: 00007FF7ED6ACD01
CloseHandle.KERNEL32 ref: 00007FF7ED6ACD12
GetLastError.KERNEL32 ref: 00007FF7ED6ACD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF7ED6ACD7D
DeleteFileW.KERNEL32 ref: 00007FF7ED6ACD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6ACED7

Strings

\??\, xrefs: 00007FF7ED6AC392, 00007FF7ED6AC3B8
SeRestorePrivilege, xrefs: 00007FF7ED6AC343
UNC\, xrefs: 00007FF7ED6AC53F, 00007FF7ED6AC55D
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF7ED6AC34F

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 00964161ca9ce986acf484eb71c93c2db3db382fc2b8f17ad7e68b1fb415a3bc
Instruction ID: fd06cd78fa8045714264f89c2fd0f333d4f2f191c95f4093d033bae8f1ff27b2
Opcode Fuzzy Hash: 00964161ca9ce986acf484eb71c93c2db3db382fc2b8f17ad7e68b1fb415a3bc
Instruction Fuzzy Hash: 4B62BF62F0C64285FB00EB74D4543ADA362AB857E4F914233DAAD57AD9EF3CE185C312

Function 00007FF7ED6BF180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7ED6C0528

Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB67
Part of subcall function 00007FF7ED6BAAE0: LoadStringW.USER32 ref: 00007FF7ED6BAB80

Part of subcall function 00007FF7ED6CB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7ED6C0429), ref: 00007FF7ED6CB110
Part of subcall function 00007FF7ED6CB0DC: SetLastError.KERNEL32 ref: 00007FF7ED6CB153

Part of subcall function 00007FF7ED6A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C0538

Strings

%ls, xrefs: 00007FF7ED6BF3AC, 00007FF7ED6BF3FF
%s: %s, xrefs: 00007FF7ED6BFC11

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 424a1e263fd4ea943b566bb6394ea34e411eb33a20c874d1edcb03b8c882655e
Instruction ID: 00e98b3d987c54227d6d57e7a61ab7d4b8bd5114c0a8f186934412c9b0b58883
Opcode Fuzzy Hash: 424a1e263fd4ea943b566bb6394ea34e411eb33a20c874d1edcb03b8c882655e
Instruction Fuzzy Hash: 8CB27662E1C68281EA10BB25E4543BAE322EFD97D0F904237E69D476E6FE7CD540C712

Function 00007FF7ED6E2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6E2C12
memcpy_s.LIBCMT ref: 00007FF7ED6E35BF
memcpy_s.LIBCMT ref: 00007FF7ED6E3666

Part of subcall function 00007FF7ED6E38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6E38EE

memcpy_s.LIBCMT ref: 00007FF7ED6E372F

Part of subcall function 00007FF7ED6DD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DD02D

Strings

1#IND, xrefs: 00007FF7ED6E37AA
1#SNAN, xrefs: 00007FF7ED6E37C9
1#INF, xrefs: 00007FF7ED6E3807
1#QNAN, xrefs: 00007FF7ED6E37E8

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 2cabf3a4fde44ee2c95e829476cc223293883523ff438461d04eceb598c2a2b5
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 35B20972E0C1828AE725AE25D5407FDB793FB4C3C8F905136DE0A97B94EB39E6048B51

Function 00007FF7ED6B1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF7ED6B1A97
GetLongPathNameW.KERNEL32 ref: 00007FF7ED6B1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF7ED6B1B21
GetShortPathNameW.KERNEL32 ref: 00007FF7ED6B1B6A

Part of subcall function 00007FF7ED6C13C4: CompareStringW.KERNEL32 ref: 00007FF7ED6C13E3

MoveFileW.KERNEL32 ref: 00007FF7ED6B1DFE
MoveFileW.KERNEL32 ref: 00007FF7ED6B1E65

Part of subcall function 00007FF7ED6B2134: CreateFileW.KERNEL32 ref: 00007FF7ED6B223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B1FED

Strings

rtmp, xrefs: 00007FF7ED6B1CF4, 00007FF7ED6B1D03

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 2d571345357ed831951e913cf5b34db2d9c750839b47aacb8777740eed476449
Instruction ID: 8ccd88fb510df8f794692213bb2afd110171048da27141d76dbfa433c3218187
Opcode Fuzzy Hash: 2d571345357ed831951e913cf5b34db2d9c750839b47aacb8777740eed476449
Instruction Fuzzy Hash: 2CF1D022F1CA8295EB10EB65D4902BDA7B2EB853C4F901133EA4D47AE9EF3CD584C751

Function 00007FF7ED6B5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7ED6B5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF7ED6B5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF7ED6B5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF7ED6B5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B5EF2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: b93ad2ce8aad967ae532d61f25a7d43417873e191935b00f4afba2dee12255a3
Instruction ID: 59cb76c462fc0837abe3d982e69e40a4211b729025895c42b30127d2b07bca35
Opcode Fuzzy Hash: b93ad2ce8aad967ae532d61f25a7d43417873e191935b00f4afba2dee12255a3
Instruction Fuzzy Hash: 8DA1A772F18B5144FE10EB7998542FCA323AB49BE8B945236DE5D17BD9EF3CE0428211

Function 00007FF7ED6D3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7ED6D318C
RtlCaptureContext.KERNEL32 ref: 00007FF7ED6D31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7ED6D31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF7ED6D3214
IsDebuggerPresent.KERNEL32 ref: 00007FF7ED6D3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7ED6D3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7ED6D3294

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 83fe68c33e4d97458f71070370918a707b1c7682de292e1754705ebfb33d4d49
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 3A316572A09B8189EB60AF60E8503ED7361FB84784F84443ADA4D47B99EF3CD658C720

Function 00007FF7ED6D76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7ED6D7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7ED6D7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF7ED6D77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF7ED6D77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7ED6D77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7ED6D77F2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: f196e898f399c815b9fd6de9a15668333175cf75504889e664af31f84836aca0
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 9C318532A08B8185DB20EF65E8503AEB3A1FB88794F900136EE9D47B99EF3CC555C711

Function 00007FF7ED6A1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6A1EBB

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 62daf4ca79de1f061943721c82fe4b1d8a79ca39ff2b6a03206309b778900290
Instruction ID: 059be13df106b488bfdaf6b1a06c16b81bef24fdc2df4dbeb443257c009ebe6b
Opcode Fuzzy Hash: 62daf4ca79de1f061943721c82fe4b1d8a79ca39ff2b6a03206309b778900290
Instruction Fuzzy Hash: E6B1C022E1868685EA10BB65D8503ADA372FB897D4F905632EA8D07BD9FF3CE544C311

Function 00007FF7ED6DFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DFAC4

Part of subcall function 00007FF7ED6D7934: GetCurrentProcess.KERNEL32(00007FF7ED6E0CCD), ref: 00007FF7ED6D7961

Strings

*?, xrefs: 00007FF7ED6DFAEB
., xrefs: 00007FF7ED6DFEE4

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: d52ff6607ed9e1aa04e91e21f773a0f6cca4a0d36ebda221249c8726976983e8
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 0651EB62F1979541EF10FF61A8206B9A396FB54BD8B844532DE1D17B85FF3CD0528321

Function 00007FF7ED6E2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7ED6E210B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 3e5002311f8386d42583b06a77e40166c5479273bc6d1a702a988aba2054cbed
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: D9D1B432B1C68687DB24DF15E28476AB792F79C784F848135CF4E97B44EA3DEA458B00

Function 00007FF7ED6AB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6ABA9D), ref: 00007FF7ED6AB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6ABA9D), ref: 00007FF7ED6AB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6ABA9D), ref: 00007FF7ED6AB743

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: 37db665d7fd316f521b60ba005e89f7f92880c82f924c0d6c701267d1ef375ff
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 24011771E0C74182D710AF16B45027AE356FB8D7C0F844036DA8D87B45EF3CD5158711

Function 00007FF7ED6DFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7ED6DFEE4

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 2c0d667f3bf6e99b6fbba627c31d18adc599bc130f0468359125a2042d2ece8b
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 0D310B22F0C6D145F720BB36B8147B9EA92AB94BE8F948236DE5C47BD5DE3CD5118301

Function 00007FF7ED6E5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7ED6E5D45
RaiseException.KERNEL32 ref: 00007FF7ED6E5D56

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 098adbcd3bcd155afa5f29e1461ae5ca7c028ebfaf20f39fbcfe6b6c96607672
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: E0B18C73A04B848BEB15CF29C84636CBBA1F748B8CF148926DE5E837A4DB3AD451C711

Function 00007FF7ED6C8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6C85E0: GetDC.USER32 ref: 00007FF7ED6C85EC
Part of subcall function 00007FF7ED6C85E0: GetDeviceCaps.GDI32 ref: 00007FF7ED6C85FD
Part of subcall function 00007FF7ED6C85E0: ReleaseDC.USER32 ref: 00007FF7ED6C860A

GetObjectW.GDI32 ref: 00007FF7ED6C8E48

Part of subcall function 00007FF7ED6C90B0: GetDC.USER32 ref: 00007FF7ED6C90D9
Part of subcall function 00007FF7ED6C90B0: GetObjectW.GDI32 ref: 00007FF7ED6C9107
Part of subcall function 00007FF7ED6C90B0: ReleaseDC.USER32 ref: 00007FF7ED6C91BB

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: a19ecd1b61d58e0608b4e7377c4d65c972bedb06e950522e775202c499caf7fb
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 23812936F08A0586EB209F6AD4406ADB772FB88B88F414123DE0D5BB64EF39D549C791

Function 00007FF7ED6CA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF7ED6CA315
GetNumberFormatW.KERNEL32 ref: 00007FF7ED6CA371

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: b588b6c2bf830b430469f88e63ad8225ccd370f57dc9aa0a65eef5f3848e0095
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 80115C22A0CB8195E761AF11E8103E9B361FF88B84FC44136DA4D47754EF3CD159C756

Function 00007FF7ED6B126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B24C0: CreateFileW.KERNELBASE ref: 00007FF7ED6B259B
Part of subcall function 00007FF7ED6B24C0: GetLastError.KERNEL32 ref: 00007FF7ED6B25AE
Part of subcall function 00007FF7ED6B24C0: CreateFileW.KERNEL32 ref: 00007FF7ED6B260E
Part of subcall function 00007FF7ED6B24C0: GetLastError.KERNEL32 ref: 00007FF7ED6B2617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B15D0

Part of subcall function 00007FF7ED6B3980: MoveFileW.KERNEL32 ref: 00007FF7ED6B39BD
Part of subcall function 00007FF7ED6B3980: MoveFileW.KERNEL32 ref: 00007FF7ED6B3A34

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: b6c9c40237190830a1427cc90f699f3ed679a8c4b0b9819d305839f030af1316
Instruction ID: 9deec26f087bb23a016223cac60a44bf81c62c306b433af4a77a8e034251730b
Opcode Fuzzy Hash: b6c9c40237190830a1427cc90f699f3ed679a8c4b0b9819d305839f030af1316
Instruction Fuzzy Hash: 8C91AE62F2CA4692EB10EB66D4443AEA362FB94BC4F804033EE4D47B95EE3CD555C361

Function 00007FF7ED6B4EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7ED6B4EE2

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: 64106566f5956a2d7af9f41fbe518a587031a39b2f31733f9c53619a21cb5fd6
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: C5018F71D5D5828DFA31BB20A8143B5EB969FE939DFC50136C59C07291EE3CB0588A36

Function 00007FF7ED6D8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7ED6D8DD3

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 399424cdc8a42975c81ddfc49bb3d0c3de0614bf9b9e41111885200304a3ee3a
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 4D812811E1C10246EAA8BB15A06877DA392EFD47C4F941633DD098F6D5EF3DE829C722

Function 00007FF7ED6D89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7ED6D8B3A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 4e4f77d40e7128cf797fb35018eaf6d0107adf9adcbcedf9f5a299066eb1bb72
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 43711611E0C24246EA64BA15B06837DA3929FC17C4F981533DD098F686EE3DE866C773

Function 00007FF7ED6BC96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF7ED6BC97B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 9ba2a18fa71f726e9b1197d54bcf31dad3d6181e23a4e9008308244427af5821
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 5F519237B286908BD724CF25E400A9EB3A5F388798F455126EF4A93B09DB3DE955CF40

Function 00007FF7ED6DC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF7ED6DC874

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 9dc54f8a76f5b30283dd6110ad043d77b0a4b27de523503731694e52dfe1fa2f
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 9841B532B18A4485EF04EF2AE4242A9B7A2A75CFD0B9D9037DE1D8B754EE7DD051C301

Function 00007FF7ED6E0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7ED6E0D24

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 78777f9d5d4ad4190e8695a7af69043c99502aaddc7ec1f419a833c1b43a8d13
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: A5B09220E1BA02C2EA483B516C8635463A5BF8C740FD8903AC50C82320EE3D29B54722

Function 00007FF7ED6C3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction ID: 4c5d86cea00000b4f703778b820255145c8e674c2d3c0a0cf180b8584e6ba2aa
Opcode Fuzzy Hash: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction Fuzzy Hash: C982D1A2E0D6C18AD705EF68D4043BCBBA2E755BC8F598137CA5A47395EA3CE445C321

Function 00007FF7ED6A76C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: f038b4fae552bf26776d6c067a15a3896bea43b64e6971503deff71cdb5aff77
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: DB627E9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF7ED6C53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction ID: e8708b4f69c56f290a79306dffbe418906e43686928398a73d23ebd8791509e3
Opcode Fuzzy Hash: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction Fuzzy Hash: 0682E0B2E0D6C18AD724DE28D8547FCBBA2E755B88F488137CA4D47785EA3CD485C722

Function 00007FF7ED6BBB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 8d2edcebb163da8f1b4b8fbb094af8042fc0dcffc6a7eb882a1237d9b042d031
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 0522F3B3B246508BD728CF25D89AE5E3766F798344B4B8229DF0ACB785DB38D505CB40

Function 00007FF7ED6C4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 289233d7145c633bb2ace55fed6236eb88eb0eccf20f34066b49d95e16f6fb52
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 1C32D272E081918BE718DF24D9547BC77A2F754B88F41813ADA4A87B88EB3CF864C751

Function 00007FF7ED6A7288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 60e26fd187f8ebed6421c339f4e8858bbabb11deb15a16286cd55f4205f407de
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 4FC19AB7B281908FE350CF6AE400A9D7BB1F39878CB519125DF59A7B09D639E605CB40

Function 00007FF7ED6C2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: f9de2f6da0a6ec9c4fc17378893d102d906f9921aaf8d69b79707e8d56151984
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 6CA12573E0C18686EB15EA24D5047BDB693EBA87C4F994136DE4907786EE3CE841C322

Function 00007FF7ED6BAF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 8cf740fc795e8313532ba44679ee69daf7d5f468e8aac95fcd07cfe6f7ed2694
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: 57C1E477E292E04DE302CBB5A4248FD3FB2E71D34DB4A4152EFA657B4AD5385201DB60

Function 00007FF7ED6AA310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 2f285794e47f0c0210e7ec601b14ed1380f165a28d3bae07410c222c50127be8
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: F6910D62E1C58196EB11EF29E4503EDA722FF957C8F841032EF8E47659EE38E646C311

Function 00007FF7ED6BB534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 640903f1009a0d84987d8ca43af2f9cc19c523f319648cca83d8881cc6acbf17
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 1D612123F1C5D049EB11DF7985006FDBBA2EB197C4B868033CE9A53646EA38E506CB21

Function 00007FF7ED6C21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 91276156fd3667208a87f6ece0bf33842f8444632b1ef08abc63ce3230aad77a
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 30510073E1C1514BE728DF28A2147ADB752FB88B88F844136DE494B689EE3DE541CB11

Function 00007FF7ED6C2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 4c4b8d96cd4bf71426369f16c3f68ccc813e6e63771f87b46553fb17a886f73f
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 9131D2A2E0C6914FDB08EE1A965037EB792F784384F44813ADF4A83B42EA7CE041C711

Function 00007FF7ED6BDC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: 4c50f49dfe191f73e43f2fe84e788ed377e1483234a99e677b021d5c7b5cb8e1
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: 6CF0FE61F9C00742FB68202858193B9905F9B11394FE46837D12FCF2C6FBBDE881192B

Function 00007FF7ED6D3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: c9a5b76bbd97da8507bca708584af1540f43c20ba1141a78290708645483750b
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 34A001A1D0CC82D0E654AB50A960270A322BB94380B910032E40D861B9AE3DA9118222

Function 00007FF7ED6AD7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD964

Strings

:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7ED6AD86A
::$FILE_NAME, xrefs: 00007FF7ED6AD833
::$EA_INFORMATION, xrefs: 00007FF7ED6AD828
::$DATA, xrefs: 00007FF7ED6AD812
::$ATTRIBUTE_LIST, xrefs: 00007FF7ED6AD7FC
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF7ED6AD85F
::$INDEX_ROOT, xrefs: 00007FF7ED6AD854
::$BITMAP, xrefs: 00007FF7ED6AD807
::$EA, xrefs: 00007FF7ED6AD81D
::$INDEX_ALLOCATION, xrefs: 00007FF7ED6AD83E
::$REPARSE_POINT, xrefs: 00007FF7ED6AD88B
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF7ED6AD849
::$OBJECT_ID, xrefs: 00007FF7ED6AD880
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7ED6AD875

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 74d68d42448b2834d40d390ad32eed462d68e051ec4e29c63c0154d737a3ceed
Instruction ID: f422420a515bcf1f082ba4c9d267bf97ce1e9093d0633063926caff8942a69f3
Opcode Fuzzy Hash: 74d68d42448b2834d40d390ad32eed462d68e051ec4e29c63c0154d737a3ceed
Instruction Fuzzy Hash: E041F736E09F0199EB00AB60E4403E873A6EB58798F800237DE4C57759FF39D265C391

Function 00007FF7ED6D2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7ED6D2A26
GetModuleHandleW.KERNEL32 ref: 00007FF7ED6D2A33
GetModuleHandleW.KERNEL32 ref: 00007FF7ED6D2A48
GetProcAddress.KERNEL32 ref: 00007FF7ED6D2A60
GetProcAddress.KERNEL32 ref: 00007FF7ED6D2A73
CreateEventW.KERNEL32 ref: 00007FF7ED6D2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF7ED6D2AEB
CloseHandle.KERNEL32 ref: 00007FF7ED6D2AFD

Strings

SleepConditionVariableCS, xrefs: 00007FF7ED6D2A56
kernel32.dll, xrefs: 00007FF7ED6D2A41
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7ED6D2A2C
WakeAllConditionVariable, xrefs: 00007FF7ED6D2A66

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: acce4564a556eec02c046142e98fac33ab832b5023e7ce78be36bea2acc839fb
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 11213260E0DA0391FA15BB11F965374A362AF8C7C4FC90037CC0E8B6A1FE3DA5658322

Function 00007FF7ED6B6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70A6

Part of subcall function 00007FF7ED6A2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7ED6A200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B70DC

Strings

DXGIDebug.dll, xrefs: 00007FF7ED6B6A18
UNC, xrefs: 00007FF7ED6B6BBF
\\?\, xrefs: 00007FF7ED6B6A57, 00007FF7ED6B6A66

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 49a63e71edebf0e47042e7ea65e43b03e9a3fa67d865ab852c8f354cac801883
Instruction ID: dd2d855fabb6cff127b9dda3d8d8ecf07e0c31417e593c09d35769438df5df61
Opcode Fuzzy Hash: 49a63e71edebf0e47042e7ea65e43b03e9a3fa67d865ab852c8f354cac801883
Instruction Fuzzy Hash: 3312A062F0CB4284EA10EB65D4542ADA372EB85BC8F904137DA9D0BBE9EF3CD545C361

Function 00007FF7ED6CA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6A129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7ED6A1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CA747
EndDialog.USER32 ref: 00007FF7ED6CA7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF7ED6CA52B, 00007FF7ED6CA53A
GETPASSWORD1, xrefs: 00007FF7ED6CA773

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: d8322a208530c57668d9ab0bd9eeb9a998ed53718cd7cec1bf797515a4396991
Instruction ID: 7fc59b2a36f3345e94136f12e73b50693328aa309c7c93ea9902f9b78dc77862
Opcode Fuzzy Hash: d8322a208530c57668d9ab0bd9eeb9a998ed53718cd7cec1bf797515a4396991
Instruction Fuzzy Hash: B2B1BF62F1D74285FB00EB65D4543AC6362AB893D8F804236DE5D2BAD9EE3CE155C322

Function 00007FF7ED6C6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7ED6C7E9B), ref: 00007FF7ED6C7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF7ED6C70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C7187

Strings

</html>, xrefs: 00007FF7ED6C6F72, 00007FF7ED6C6F81
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF7ED6C6ED5, 00007FF7ED6C6EE4
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF7ED6C6F2C, 00007FF7ED6C6F3B
<html>, xrefs: 00007FF7ED6C6F13

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 99020ba5446ec8b5071b5be278ebc62a02c6a64c5a04705e5c2bdc59161e89ed
Instruction ID: cf5c52dd6e0a3ecaf111a72dc97da950d793454ec42756beb10009b9835d7cdf
Opcode Fuzzy Hash: 99020ba5446ec8b5071b5be278ebc62a02c6a64c5a04705e5c2bdc59161e89ed
Instruction Fuzzy Hash: 49818F62F1CA4285EB00EBA5D4503EDA372AF487D8F840137DE1D1BA99FE38D516C366

Function 00007FF7ED6DE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DE7CD

Strings

NAN, xrefs: 00007FF7ED6DE6B1
nan(ind), xrefs: 00007FF7ED6DE706
nan(snan), xrefs: 00007FF7ED6DE6F0
INF, xrefs: 00007FF7ED6DE6C3
NAN(IND), xrefs: 00007FF7ED6DE6FB
NAN(SNAN), xrefs: 00007FF7ED6DE6E5
nan, xrefs: 00007FF7ED6DE6B8
inf, xrefs: 00007FF7ED6DE6D6

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: f7f6b9beca55a7ab2da742ef85c92777ec276fe42ef2f25287ec9f2f26f7eba3
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: A041DD32E09B4188E700EF24E8517AD73A6EB183D4F814136EE9C47B49EE3DD125C355

Function 00007FF7ED6CF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF7ED6CF3CF
GetClassNameW.USER32 ref: 00007FF7ED6CF3FC
GetWindowLongPtrW.USER32 ref: 00007FF7ED6CF41D
SendMessageW.USER32 ref: 00007FF7ED6CF437
GetObjectW.GDI32 ref: 00007FF7ED6CF452
SendMessageW.USER32 ref: 00007FF7ED6CF487
DeleteObject.GDI32 ref: 00007FF7ED6CF490
GetWindow.USER32 ref: 00007FF7ED6CF49E

Strings

STATIC, xrefs: 00007FF7ED6CF402

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 7b0714fa1d5b707a8c894a523f000cb064192f518d4ff00f85d409e310258584
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: E131C821F0DA4242FA60BB12A9547BDA3A2BF8CBC4F814432DD4D07B96FE3CD4058761

Function 00007FF7ED6CAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF7ED6CAEAE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 0fe41acdfbcdfb155d32531a7697bc45f1871cbfd68f077253aa1bfcfed36fba
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: B7419F21F0CB5282FB54AB15A81477DA7A2AF88BC8F944037D90E07B95EF3CE5558362

Function 00007FF7ED6BB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7ED6BBA12
GetProcAddress.KERNEL32 ref: 00007FF7ED6BBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF7ED6BBACA

Part of subcall function 00007FF7ED6BDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7ED6BDDDF

Strings

Crypt32.dll, xrefs: 00007FF7ED6BB9F0
CryptProtectMemory, xrefs: 00007FF7ED6BBA08
CryptUnprotectMemory, xrefs: 00007FF7ED6BBA1F
CryptUnprotectMemory failed, xrefs: 00007FF7ED6BBAC1
CryptProtectMemory failed, xrefs: 00007FF7ED6BBA80

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: d3c9a0361444da9cb7e59e4784cf6e767b5776913535653ba9dd4d20aa216794
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 96315A20E0DB4280FA14BB19E854375A3A2EF88BD4F841137DD4E877A4FE3DE9558322

Function 00007FF7ED6C87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6C8DE0

Strings

, xrefs: 00007FF7ED6C8A55
, xrefs: 00007FF7ED6C88BE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: f030c4eb17d52201791ace9f286aabb5ba9f942de39f9151f6af03753080fb30
Instruction ID: 3ad6bf4dbf2c33a3e4ec5e2aeeff5519843a4783a6a8f1bd3355acb0641d3ed3
Opcode Fuzzy Hash: f030c4eb17d52201791ace9f286aabb5ba9f942de39f9151f6af03753080fb30
Instruction Fuzzy Hash: 47F1E162F1C74240EE20AB65D4542BCA363AB54BE8F815632CA5D1B7D9FF7CE084C362

Function 00007FF7ED6D57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7ED6D598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7ED6D5CAD
abort.LIBCMT ref: 00007FF7ED6D5CE1

Strings

csm, xrefs: 00007FF7ED6D58D1
csm, xrefs: 00007FF7ED6D5933
csm, xrefs: 00007FF7ED6D59B1

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 4cc9c42422f7b34e03fcbda1bfc243cc4a12181d214437984c7ec0acd1305717
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 10E1B272D0C7828AE710BF64E4A03ADB7A1FB4678CF940136DA8D47A55EF38E495C712

Function 00007FF7ED6B4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B4E24: SysAllocString.OLEAUT32 ref: 00007FF7ED6B4E5F

VariantClear.OLEAUT32 ref: 00007FF7ED6B5125

Strings

Name, xrefs: 00007FF7ED6B50F9
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF7ED6B5017
WQL, xrefs: 00007FF7ED6B502A
ROOT\CIMV2, xrefs: 00007FF7ED6B4F7B
Windows 10, xrefs: 00007FF7ED6B510A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 8ce0faaad88994b5a22afe87a8c5762eb183490f7416ba954338232d2c9cc412
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: E1714B36A18A0585EB20EF25E8806ADB7B5FB88BD8F805133DE4D47B64EF39D544C351

Function 00007FF7ED6D72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7ED6D74F3,?,?,?,00007FF7ED6D525E,?,?,?,00007FF7ED6D5219), ref: 00007FF7ED6D7371
GetLastError.KERNEL32(?,?,00000000,00007FF7ED6D74F3,?,?,?,00007FF7ED6D525E,?,?,?,00007FF7ED6D5219), ref: 00007FF7ED6D737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7ED6D74F3,?,?,?,00007FF7ED6D525E,?,?,?,00007FF7ED6D5219), ref: 00007FF7ED6D73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF7ED6D74F3,?,?,?,00007FF7ED6D525E,?,?,?,00007FF7ED6D5219), ref: 00007FF7ED6D73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7ED6D74F3,?,?,?,00007FF7ED6D525E,?,?,?,00007FF7ED6D5219), ref: 00007FF7ED6D73FB

Strings

api-ms-, xrefs: 00007FF7ED6D7391

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: d2f621655db13084f361ff27f031f73405a7bb3c4fa35628da668fe72bb90796
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: D5319321E1E64281EE12BB06B810775A396FF48BE0F9A4536DD1E4B344FF3CE4518722

Function 00007FF7ED6D1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF7ED6D1573,?,?,?,00007FF7ED6D192A), ref: 00007FF7ED6D162B
GetProcAddress.KERNEL32(?,?,?,00007FF7ED6D1573,?,?,?,00007FF7ED6D192A), ref: 00007FF7ED6D1648
GetProcAddress.KERNEL32(?,?,?,00007FF7ED6D1573,?,?,?,00007FF7ED6D192A), ref: 00007FF7ED6D1664

Strings

AcquireSRWLockExclusive, xrefs: 00007FF7ED6D163E
ReleaseSRWLockExclusive, xrefs: 00007FF7ED6D1653
KERNEL32.DLL, xrefs: 00007FF7ED6D1624

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 81761eaf26387584c322b137a794b0d735a2dc8b73fb3614cbfd2a7ef7fcad89
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 9A111820E4EB8381EE65BB00B96037492A26F487D4FCD4437C81D8B3D0FEBDA5658622

Function 00007FF7ED6BED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B51A4: GetVersionExW.KERNEL32 ref: 00007FF7ED6B51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7ED6A5AB4), ref: 00007FF7ED6BEE05

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: eff124cba84399a59dd38a607566fb1cabcb40c238378247b5d3da0800b82b89
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: E4517DB2F146518EEB14DFA8D4402AC77B2F748788BA0403ADE0D67B58EF38D556C750

Function 00007FF7ED6BF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF7ED6BF074

Part of subcall function 00007FF7ED6B51A4: GetVersionExW.KERNEL32 ref: 00007FF7ED6B51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7ED6BF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF7ED6BF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF7ED6BF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF7ED6BF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF7ED6BF0CE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 3402c3df4fa5e5fb3a500059ef7fbcd2172c97c4d830aacafa7f4274382494ef
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: EC315B62F14A518DFB00DFB5E8902AC7771FF08798B94502AEE0DA7A68EF38D595C311

Function 00007FF7ED6B7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B7C8C

Strings

.rar, xrefs: 00007FF7ED6B7969, 00007FF7ED6B7978
sfx, xrefs: 00007FF7ED6B79F3, 00007FF7ED6B7A02
rar, xrefs: 00007FF7ED6B7A9B, 00007FF7ED6B7AAA, 00007FF7ED6B7B67, 00007FF7ED6B7B7C
exe, xrefs: 00007FF7ED6B79AF, 00007FF7ED6B79BE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: ded382a5f33e5d00d019a19aa0952dad5d31072c5da8fffb523e0446b7f74fbf
Instruction ID: fbadd378434d83ff00666204ba240baed453ad7c06572f566d9677bf3deea15e
Opcode Fuzzy Hash: ded382a5f33e5d00d019a19aa0952dad5d31072c5da8fffb523e0446b7f74fbf
Instruction Fuzzy Hash: C2A19F22E1CB0650EA00BF25D4553B8A362AF54BD8F941237DE1D0B6D5EF3CE551C362

Function 00007FF7ED6D5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7ED6D5D58

Part of subcall function 00007FF7ED6D5210: abort.LIBCMT ref: 00007FF7ED6D5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF7ED6D5DA3
abort.LIBCMT ref: 00007FF7ED6D5FD1

Strings

MOC, xrefs: 00007FF7ED6D5D6C
RCC, xrefs: 00007FF7ED6D5D74

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 325b3a866a552c5d0baaad850a25074be752d28e953ecfb0f83cab89f9e31420
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 8D91BD73E08B818AE710EF65E4503ADBBA1F745788F50412AEE8C07B59EF38D1A5CB11

Function 00007FF7ED6D4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7ED6D4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7ED6D5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6D2F5E), ref: 00007FF7ED6D508F

Strings

f, xrefs: 00007FF7ED6D4FBE
csm, xrefs: 00007FF7ED6D5026

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 27f89370322504d787b86aac2b584e655538ee8c110cad2bcc97a0e8234c4d65
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 0A51C232E1D20286DB14FB15F854B39B396FB45BCCF908032DA1A47B48EF79E9518752

Function 00007FF7ED6ACEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7ED6AD03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD0D7

Part of subcall function 00007FF7ED6ADE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7ED6ACF4B), ref: 00007FF7ED6ADE27
Part of subcall function 00007FF7ED6ADE04: GetLastError.KERNEL32 ref: 00007FF7ED6ADE88
Part of subcall function 00007FF7ED6ADE04: CloseHandle.KERNEL32 ref: 00007FF7ED6ADE9B

Strings

SeRestorePrivilege, xrefs: 00007FF7ED6ACF5E
SeSecurityPrivilege, xrefs: 00007FF7ED6ACF3F

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: cc2cdb65981a4fcc868e5d913d4f06653a23f25da57a99a038b17aaaeb8469e6
Instruction ID: a8858dc15f0002c8b7d9a2c6fc68fd705c2cd2dc21429a47c8f785f115bc0ccb
Opcode Fuzzy Hash: cc2cdb65981a4fcc868e5d913d4f06653a23f25da57a99a038b17aaaeb8469e6
Instruction Fuzzy Hash: D851E462F1C65245FB00FB65D8503BDA7A2AF887E8F801132DE5D176D6FE3CA485C222

Function 00007FF7ED6C7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7ED6C7B6F
GetWindowRect.USER32 ref: 00007FF7ED6C7BC0
ShowWindow.USER32 ref: 00007FF7ED6C7C96
ShowWindow.USER32 ref: 00007FF7ED6C7CC3

Strings

RarHtmlClassName, xrefs: 00007FF7ED6C7C4B

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction ID: b0d3fb45564865c77573ab16d5f258a5412512fa017dbc618a600b0daea319ce
Opcode Fuzzy Hash: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction Fuzzy Hash: 03519421A0CB428AEA24AF25E45437EE7A1FF897C0F844436DE8E47B95EF3CE4458711

Function 00007FF7ED6CFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6CFD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7ED6CFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6CFE1B

Strings

sfxcmd, xrefs: 00007FF7ED6CFD3C
sfxpar, xrefs: 00007FF7ED6CFDB5

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 42a5c16ff962b42e9c466757ddc2add4312beed441a9accfeec164922430c806
Instruction ID: e4fbf7ee9fe8537604d18eaba42b233cddec37b9bb5ce4a3e6816925f381656d
Opcode Fuzzy Hash: 42a5c16ff962b42e9c466757ddc2add4312beed441a9accfeec164922430c806
Instruction Fuzzy Hash: C0319432E18A0584EB00EF65E4843AC7372FB48BD8F941132DE5D5B7A9EE38E155C355

Function 00007FF7ED6CFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF7ED6CFF60
REPLACEFILEDLG, xrefs: 00007FF7ED6CFF34, 00007FF7ED6CFF99

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: a9e5d166a4ba1b9b43ec9778d33859deb3922c9422ea2a3fb0630315b9572eca
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: DC210721D0DB4780FA10AB19B844374E7A2EB4DBC8F940437D98D472A0FE3CE5A98362

Function 00007FF7ED6DBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7ED6DBFD0
GetProcAddress.KERNEL32 ref: 00007FF7ED6DBFE6
FreeLibrary.KERNEL32 ref: 00007FF7ED6DC00B

Strings

mscoree.dll, xrefs: 00007FF7ED6DBFC7
CorExitProcess, xrefs: 00007FF7ED6DBFDF

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: 2cb6999c5e03d12bcbbcaa7f13e573ea8d2b25d0539438fd84afadce294ea0b8
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 71F04F21E1DA4281EE44AB11F454379A362EF8C7D4F851037ED4F87664EE3EE5848721

Function 00007FF7ED6E45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6E4605

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 78c08d5f10b108593cd9be9b475228476b9874087d572ae5dab0216a41720cf4
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: E681D222E1C65249FB10BB7198403BDA7A2BB49BC8F804137CD0E97695EF3EE515C722

Function 00007FF7ED6B3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7ED6B3BBB
CreateFileW.KERNEL32 ref: 00007FF7ED6B3C24
SetFileTime.KERNEL32 ref: 00007FF7ED6B3CEC
CloseHandle.KERNEL32 ref: 00007FF7ED6B3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B3D2C

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 94d33130e0d3e07453908689b86af48371af1e3e167329ed22bda644dbf2c176
Instruction ID: 2df34b2235944fadd8b9df1aedee46fd2704ff62ae7fe39eb1b38bdf89762cc9
Opcode Fuzzy Hash: 94d33130e0d3e07453908689b86af48371af1e3e167329ed22bda644dbf2c176
Instruction Fuzzy Hash: 1C51D322F0CA0249FB10EFA5E4503BDA372AB987E8F804636DE1D477E9EF3895158311

Function 00007FF7ED6E3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7ED6E4767), ref: 00007FF7ED6E3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF7ED6E406D
WriteFile.KERNEL32 ref: 00007FF7ED6E4093
WriteFile.KERNEL32 ref: 00007FF7ED6E40D2
GetLastError.KERNEL32 ref: 00007FF7ED6E410A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: ae854ae13a01b3c2dbcbdfa77803ad006297704d80b396255f53e36d95702a98
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: C351F332E18A5189E710DB35D4403ACBB72FB587D8F448136CE0A97B99EF39E145C721

Function 00007FF7ED6D1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7ED6B4DF4), ref: 00007FF7ED6D1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7ED6B4DF4), ref: 00007FF7ED6D1F09
SysAllocString.OLEAUT32 ref: 00007FF7ED6D1F16

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 7e9601d2247a13adf5892490d0984888a090eff7ba9d3fa4ff308a8b8e371313
Instruction ID: 5d17423b1ff6dd5bef7a7314aa0f9ad2dd1bfcc865d571b7e26b5917351b999b
Opcode Fuzzy Hash: 7e9601d2247a13adf5892490d0984888a090eff7ba9d3fa4ff308a8b8e371313
Instruction Fuzzy Hash: 3C410931E0C74589EB14BF61A420378A2E2EF48BE4F944636EA2D877D5EF7CD1618321

Function 00007FF7ED6DF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7ED6DF536

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 318cbf0895123c816e76bc31f27f48a5df061102eada2fa4388a79459bb9e334
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: B041D061F0DA8281FA15BF12B8107B5A296BF58BD4F994537DD1E8B644FE3CE4108322

Function 00007FF7ED6E56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7ED6E56FF
_set_statfp.LIBCMT ref: 00007FF7ED6E571A
_set_statfp.LIBCMT ref: 00007FF7ED6E5736
_set_statfp.LIBCMT ref: 00007FF7ED6E5772

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 26445083109634d19684735df288602d39542f006028903e2aa8685716b0f10c
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 4B11BE36E1C71781FA142124E0423798443AF4C3E8EC84232EE7F8B1D6FE7EAA504123

Function 00007FF7ED6CFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF7ED6CFE41
GetMessageW.USER32 ref: 00007FF7ED6CFE58
TranslateMessage.USER32 ref: 00007FF7ED6CFE63
DispatchMessageW.USER32 ref: 00007FF7ED6CFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF7ED6CFE7C

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: c8fbe9154eeb4001dc44ea6521fda409d3425e12496eb4bf579811f8a8a82444
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 24F06221F3C44692F710A720E854B7AA212FFECB89FC41032E94E82994EE3CD159C721

Function 00007FF7ED6D625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7ED6D6286
abort.LIBCMT ref: 00007FF7ED6D64EA

Strings

csm, xrefs: 00007FF7ED6D641A
csm, xrefs: 00007FF7ED6D62AB

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: cf07203b98d1c4e2a5a243276e923f97743910348162c124daff62b8c2796cd6
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 3771C27290C6858AD760BF65A06077DFBA2EB01BC8F448137DA4D47A89EF3CD4A4C752

Function 00007FF7ED6D80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6D811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6D82ED

Strings

*, xrefs: 00007FF7ED6D8221
, xrefs: 00007FF7ED6D8276

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 3ecf8cc0280739324efbca1f9c4a4d6a8ee86d63e3b1cd6e5aea7ddd9d475657
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 8B51A872C0C6428AE764FF28A46C33C7762EB85B88F941137C54A4B19DEF38D465C666

Function 00007FF7ED6E1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7ED6E17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF7ED6E1894
GetStringTypeW.KERNEL32 ref: 00007FF7ED6E18AE

Strings

$%s, xrefs: 00007FF7ED6E175A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 7ba64abbd9c70d917bc641dff5befdf2657340f49e59d081931e7d4cd3a2123a
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: A041BA22F18B8149EB10AF25D8007A9A3A6FB58BE8F840632DE1D477C5FF3DE5418352

Function 00007FF7ED6D66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6D5210: abort.LIBCMT ref: 00007FF7ED6D5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7ED6D674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7ED6D6776

Strings

csm, xrefs: 00007FF7ED6D6876

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: ecba308477324cf3d207a8922d0a901e0eec2e6b5bb23a89a91bdba2c320388b
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 3A515932A1C74687D620FB56B05076EB7A5FB89B90F940136EA8D07B55EF38E460CB12

Function 00007FF7ED6E4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7ED6E4446
WriteFile.KERNEL32 ref: 00007FF7ED6E4479
GetLastError.KERNEL32 ref: 00007FF7ED6E449B

Strings

U, xrefs: 00007FF7ED6E4424

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: a864f0951001de7d89bdffb9c15fcf9cd8a2190d1d077f111efacb00076ebf7f
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 6E41C322B1CA8186D720EF25E8043B9A762FB887D4F814132EE4D87788EF7DE541C751

Function 00007FF7ED6C90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7ED6C90D9
GetObjectW.GDI32 ref: 00007FF7ED6C9107
ReleaseDC.USER32 ref: 00007FF7ED6C91BB

Strings

, xrefs: 00007FF7ED6C9153

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: f6324b841f61a99155fecc6badb89e4f61fb158daf2e03fd3c029f03429e07f6
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 6C311C3561874186EA18AF12BC1872EB761F78DFD5F908436ED4A43B94DE3CD459CB10

Function 00007FF7ED6BE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF7ED6C317F,?,?,00001000,00007FF7ED6AE51D), ref: 00007FF7ED6BE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF7ED6C317F,?,?,00001000,00007FF7ED6AE51D), ref: 00007FF7ED6BE8CB
CreateEventW.KERNEL32(?,?,?,00007FF7ED6C317F,?,?,00001000,00007FF7ED6AE51D), ref: 00007FF7ED6BE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF7ED6BE900

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 2449dfa4fcf69eb8725219ed961c89c76240f55488d3f1c2f65ccb7e23203a1d
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: BE21D832E1DA4286F710AF24D4543AD7393EB98B4CF588036CA0D4B295EF7E9455C7A1

Function 00007FF7ED6C85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7ED6C85EC
GetDeviceCaps.GDI32 ref: 00007FF7ED6C85FD
ReleaseDC.USER32 ref: 00007FF7ED6C860A

Strings

, xrefs: 00007FF7ED6C8610

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: b0e4cd00f22b66eedcba7bc693a77100fa31319fd8560c59271682eaf4a8e2e3
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 27E0C220B0CA4182FB0C67B6B98923EA261AB4CBD4F958036DA1F837D4EE3CC4E44310

Function 00007FF7ED6AD1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF7ED6AD46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AD560

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 3e0de6b87fc756f79ac571a371d77b74ab10159eff9a06e36aa9ff194842a8ae
Instruction ID: a4dafe93b829ac9bad4cc50e0b3efa802f5bfe3b2b5e99975904f734981ab500
Opcode Fuzzy Hash: 3e0de6b87fc756f79ac571a371d77b74ab10159eff9a06e36aa9ff194842a8ae
Instruction Fuzzy Hash: 47A17162E1CA8291EA10EB65E4503ADA362FF857C4F805132EA9D07AE9FF3CE544C711

Function 00007FF7ED6C0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7ED6C05FC
SetLastError.KERNEL32 ref: 00007FF7ED6C0697

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e740716fb16c43b695f5f219d8f3a9084bf63b213528ce6e7a445183d4fb0460
Instruction ID: 4faa4c0fc754f60bf1f45a9bfa6406431f77af237a31e053138d571db730457e
Opcode Fuzzy Hash: e740716fb16c43b695f5f219d8f3a9084bf63b213528ce6e7a445183d4fb0460
Instruction Fuzzy Hash: 2D517E62F58A4295EB00BF65D4553ACA322EB88BD8F904133DA5C577DAFE3CD244C362

Function 00007FF7ED6C9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7ED6C9DBC
GetLastError.KERNEL32 ref: 00007FF7ED6C9E08
CreateDirectoryW.KERNEL32 ref: 00007FF7ED6C9F10
LocalFree.KERNEL32 ref: 00007FF7ED6C9F20

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: decc2da6846149065e747433b686ffe20880dedc2611ac47de6390cb5f5191d4
Instruction ID: 2e8154627ad08a895ae76b21a682476d6923455318bce9e44e26aee41cc4d8b5
Opcode Fuzzy Hash: decc2da6846149065e747433b686ffe20880dedc2611ac47de6390cb5f5191d4
Instruction Fuzzy Hash: 76515E32A1CB8286E750AF21E8443AEB765FB88BC4F905037EA4D57A58EF3CD514CB51

Function 00007FF7ED6DDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF7ED6DDC81
GetLastError.KERNEL32 ref: 00007FF7ED6DDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DDCD6

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 413298e1f535ddae9d61cc843e02cc5f49f2497f09c9766096a61b584338a8ea
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 7341D272E0C78246FB21BB11B060379E296EF80BD4F949132DA4D47AD5EF7CD8518B22

Function 00007FF7ED6B3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF7ED6B39BD
MoveFileW.KERNEL32 ref: 00007FF7ED6B3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B3AF1

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 2b6e6cda77fd8470acf22c2ab4e7c3ce966b7b843ddf4af9049b565a023b9c35
Instruction ID: 268ef5925edaa34a7c20ed97b915550ef51683ccb57b69593e6d7b7c952f176c
Opcode Fuzzy Hash: 2b6e6cda77fd8470acf22c2ab4e7c3ce966b7b843ddf4af9049b565a023b9c35
Instruction Fuzzy Hash: B041B262F18B5184FB00EF79E8452AC6372BF48BD4B905232DE5D2BAA9EF78D145C311

Function 00007FF7ED6E0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6DC45B), ref: 00007FF7ED6E0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6DC45B), ref: 00007FF7ED6E0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6DC45B), ref: 00007FF7ED6E0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7ED6DC45B), ref: 00007FF7ED6E0C57

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 08e366888656e6b59db1dcea2d6d41fc0439807d03a0d675e20e69ffb4221a7a
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 1B21C421E1CB5181DB20AF116440229E3A6FB9CFD0B884136DE8DA7BD4EF3DD5529311

Function 00007FF7ED6DD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7ED6D7F28,?,?,?,00007FF7ED6D9D35), ref: 00007FF7ED6DD44A
SetLastError.KERNEL32(?,?,?,00007FF7ED6D7F28,?,?,?,00007FF7ED6D9D35), ref: 00007FF7ED6DD4B2
SetLastError.KERNEL32(?,?,?,00007FF7ED6D7F28,?,?,?,00007FF7ED6D9D35), ref: 00007FF7ED6DD4C8
abort.LIBCMT ref: 00007FF7ED6DD4CE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: ca591df926d06b7f6e04b7bfe7efc2688ee14979175f8e59a93e50b61c1c52d7
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 7301C010F0D74342FA187B25B52537892535F847D4F84143AD81E077D6FE3CB8248A32

Function 00007FF7ED6C8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7ED6C8598
GetDeviceCaps.GDI32 ref: 00007FF7ED6C85AE
GetDeviceCaps.GDI32 ref: 00007FF7ED6C85C2
ReleaseDC.USER32 ref: 00007FF7ED6C85D3

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 3c2e9c8be89ac945140fde4f9c2efc361cafd07c9569e267c57d5cb9e35235e6
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 66E07D60E0DA0682FF5C7B756C5923AA291AF4C789F98C43BD81E473D0FD3CA5A58621

Function 00007FF7ED6AE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6AE549

Strings

DXGIDebug.dll, xrefs: 00007FF7ED6AE35A

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 0ad4200ea2e17e03f5faeaa6ee63d869aa1a242b7c6a49e8d582d697c98f1931
Instruction ID: 0d30f3b2c807745b64599f07685ef68f59b49f7ce42e6dbb97a7fa6e506a8be2
Opcode Fuzzy Hash: 0ad4200ea2e17e03f5faeaa6ee63d869aa1a242b7c6a49e8d582d697c98f1931
Instruction Fuzzy Hash: 16719D72A18B8186EB14EF25E5403ADB3AAFB547D4F844226DBAD07B95EF7CD061C310

Function 00007FF7ED6DE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DE237

Strings

gfff, xrefs: 00007FF7ED6DE362
e+000, xrefs: 00007FF7ED6DE2DF

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: e892eeb3cd007ac43f5072113c2311ddb81d78fa146b44dd86c3a5f1644c6358
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 5D510962F1C7C146E725AB35A85036DBA92A781BD0F889232C69C87BDADF3CD454C712

Function 00007FF7ED6B9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6B95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6B95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7ED6B95A2

Strings

SIZE, xrefs: 00007FF7ED6B9443

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 049592b23eccf18b91a3e94430bb7a89aa9f7458b84fc95e0ae4febadba54acb
Instruction ID: 9e5f47542f9ba76cb708f6e4a81c6097e3eddc325940cc39aa10d77dccc404a1
Opcode Fuzzy Hash: 049592b23eccf18b91a3e94430bb7a89aa9f7458b84fc95e0ae4febadba54acb
Instruction Fuzzy Hash: D5418063E2C64285EA10EB15E4413B9A362AF957D4F904233EA9D076D6FE3CD940C722

Function 00007FF7ED6DC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7ED6DC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7ED6D2CD5), ref: 00007FF7ED6DC30B

Strings

C:\Users\user\Desktop\442.docx.exe, xrefs: 00007FF7ED6DC2F9

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\442.docx.exe
API String ID: 3307058713-4147804102
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: b181654ccaecdb08d8f84119de0134ef184e3949ab7cd0c3f0b2af7fa72c618c
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 96419232E0CA5686EB14BF21B8602B8A795EB487D4F864033E94D47785EF3EE4618761

Function 00007FF7ED6C9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7ED6A255C: GetDlgItem.USER32 ref: 00007FF7ED6A25AC
Part of subcall function 00007FF7ED6A255C: SetWindowTextW.USER32 ref: 00007FF7ED6A25C8

EndDialog.USER32 ref: 00007FF7ED6C9C24
SetDlgItemTextW.USER32 ref: 00007FF7ED6C9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF7ED6C9B72

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction ID: 8198871275f0f3706da2b500b238eac0ed2859f8484da6d2281da7e95da3672c
Opcode Fuzzy Hash: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction Fuzzy Hash: 0E41B821E0C68281FB10BB11E9543B9A3A2AF89BC5F940037DE4D077D5EF3CE4558362

Function 00007FF7ED6B9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7ED6B96EA

Part of subcall function 00007FF7ED6C0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7ED6C0F99

Strings

$%s, xrefs: 00007FF7ED6B96D7
@%s, xrefs: 00007FF7ED6B96CE

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: b021fe658561eca9aa3f6f2fa68dfcdfff1f2d8cfa3c056ed1854310f766f866
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: BA319C72F1CA4685EA10EF66A4407E9A3A2EB587C4F901033EE0D07795FE3DE915C751

Function 00007FF7ED6DEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7ED6DEB76
GetFileType.KERNEL32 ref: 00007FF7ED6DEB8C

Strings

@, xrefs: 00007FF7ED6DEBB7

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 52cfefb09ec0c5046803780ae5e1cae0ab59a9087401edd1a5b5a1823f3c4c08
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 1321BB22E0CB4241EB647B24A5A023CA652EB857B4F541337D6AF077D5EE39E491C332

Function 00007FF7ED6D4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7ED6D1D3E), ref: 00007FF7ED6D40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7ED6D1D3E), ref: 00007FF7ED6D4102

Strings

csm, xrefs: 00007FF7ED6D40EF

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 93adbd35d4efd052c539bab14cb43059c9206bbce2c964c0d313df01bb61d98a
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 75112B32A18B4182EB209B15F440269B7A2FB88B94F584232DE8D07B54EF3DD965C701

Function 00007FF7ED6BEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7ED6BE95F,?,?,?,00007FF7ED6B463A,?,?,?), ref: 00007FF7ED6BEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7ED6BE95F,?,?,?,00007FF7ED6B463A,?,?,?), ref: 00007FF7ED6BEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF7ED6BEA78

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 38b3e9c2bc781ccf778978183a97a42e5e7a15d8493bd0c3aabe9c55627400c4
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 29E01A65E1D84281F600B725AC426B8B2127FA87F4FD01333D43E835E1BE7DAA458322

Function 00007FF7ED6BA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7ED6BA447
FindResourceW.KERNEL32 ref: 00007FF7ED6BA45D

Strings

RTL, xrefs: 00007FF7ED6BA453

Memory Dump Source

Source File: 00000000.00000002.1731516402.00007FF7ED6A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7ED6A0000, based on PE: true

Associated: 00000000.00000002.1731363037.00007FF7ED6A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731767290.00007FF7ED6E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED6FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731922513.00007FF7ED704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732149068.00007FF7ED70E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ed6a0000_442.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 86d9fe40c9f97898f9f6445530970c4cebf57dfd16ed5bedf27ccddc16b378f8
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: A4D01791F0D60282FF196B65A44937552525F5DB81FC8407ACC0A8B390FE7E9288C762

Analysis Process: rfusclient.exePID: 1900, Parent PID: 7620COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1057
Total number of Limit Nodes:	13

Executed Functions

Function 600E6B90 Relevance: 19.6, APIs: 13, Instructions: 128
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 600E6BAD
CreateEventA.KERNEL32 ref: 600E6BD5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 600E6C17
GetCurrentThread.KERNEL32 ref: 600E6C1B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 600E6C23
DuplicateHandle.KERNELBASE ref: 600E6C4F
GetThreadPriority.KERNEL32 ref: 600E6C66
TlsSetValue.KERNEL32 ref: 600E6C92
TlsGetValue.KERNEL32 ref: 600E6CD0
abort.MSVCRT(?,?,?,431BDE83,600E9B07), ref: 6019242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,600E9B07), ref: 6019246C
GetProcAddress.KERNEL32 ref: 6019248C
GetProcAddress.KERNEL32 ref: 601924A0

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: Current$Thread$AddressHandleProcProcessValue$CreateDuplicateEventModulePriorityabort
String ID:
API String ID: 1214264455-0
Opcode ID: 236f23135b5d89f3cb4c06a187c8cfb0046fe36029e65a5745c1d9fe07f9eb78
Instruction ID: e915a568f5e18e3e1f426d6f5f0c665b5738655c19bd6e66962b8c2fed16807d
Opcode Fuzzy Hash: 236f23135b5d89f3cb4c06a187c8cfb0046fe36029e65a5745c1d9fe07f9eb78
Instruction Fuzzy Hash: CA4126B18053008FDB00AF79D98931ABFF8FB55355F004A6DE894A7362E774D954CBA2

Function 600D8BA0 Relevance: 24.1, APIs: 16, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 60192382
abort.MSVCRT ref: 60192387
abort.MSVCRT ref: 6019238C
abort.MSVCRT ref: 60192394
abort.MSVCRT ref: 60192399
abort.MSVCRT ref: 6019239E
abort.MSVCRT ref: 601923A3
abort.MSVCRT ref: 601923A8
abort.MSVCRT ref: 601923AD
abort.MSVCRT ref: 601923B2
abort.MSVCRT ref: 601923B7
abort.MSVCRT ref: 601923BC
abort.MSVCRT ref: 601923C1
abort.MSVCRT ref: 601923C8
abort.MSVCRT ref: 601923CD

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d78a90210c76e5a2b6417dc27f1dd522e6230d59ab4647d53ef74b660d17205a
Instruction ID: 713350c3da0e976487b19910694c8c1590649592dd77fc60ad8bf66ee5b73b15
Opcode Fuzzy Hash: d78a90210c76e5a2b6417dc27f1dd522e6230d59ab4647d53ef74b660d17205a
Instruction Fuzzy Hash: 9301B9F09442068FD711DF3AC4817297FE4BB62319F850855E4405B352D738D99897E2

Function 600E4970 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 600E4989
_unlock.MSVCRT ref: 600E49B1
calloc.MSVCRT ref: 600E49FF

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction ID: 3f7e5ee77e883f8673cc9aaf2f1c30131088bc13792a89d4c7e2e13a814490d1
Opcode Fuzzy Hash: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction Fuzzy Hash: 2F115E71A042119FDB40DF29D58071ABBE4FF99310F15C6A9D898EF346EB74D844CBA2

Function 5FE512F0 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 5FE5134C

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cf30e3f8ef4daa56265915da22653f703b05a9560a876c0c26b8aa61ad415da6
Instruction ID: adb6df29bf44fac9b5f83beabba12f700d18377302e20217c909c7c22830267b
Opcode Fuzzy Hash: cf30e3f8ef4daa56265915da22653f703b05a9560a876c0c26b8aa61ad415da6
Instruction Fuzzy Hash: 061161B1A083019BD7006F69DC9066FBBE4AF84658F414C2EE4D4D7A01E778E4808B83

Non-executed Functions

Function 600E6AD0 Relevance: 10.6, APIs: 7, Instructions: 93
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 600E64C0: calloc.MSVCRT ref: 600E654E

TlsAlloc.KERNEL32(?,?,00000000,600E801E,?,?,?,431BDE83,600E9B07), ref: 600E6B04
fprintf.MSVCRT ref: 600E6B69
abort.MSVCRT(?,?,?,431BDE83,600E9B07), ref: 60192425
abort.MSVCRT(?,?,?,431BDE83,600E9B07), ref: 6019242A
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,431BDE83,600E9B07), ref: 6019246C
GetProcAddress.KERNEL32 ref: 6019248C
GetProcAddress.KERNEL32 ref: 601924A0

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: AddressProcabort$AllocHandleModulecallocfprintf
String ID:
API String ID: 2703921052-0
Opcode ID: 4a4cd23b301967684272b5538af5ddac30e8c744c9fea7f7adf1b72019aaca21
Instruction ID: ad5b60d5a1c0be2d8e43007db2ab93e90fb525d22be0a6333c5b7c22edcf21d7
Opcode Fuzzy Hash: 4a4cd23b301967684272b5538af5ddac30e8c744c9fea7f7adf1b72019aaca21
Instruction Fuzzy Hash: 6B3181B15042109FDB02AF29E88672EBFF8FF65359F01452EE584A7371D77488548B52

Function 5FD23D30 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FD23DDA

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 79d3cb5a864bdc0b14ce0c9d731882356adca2f29bd61e5150b61395f1387a37
Instruction ID: 44df5d0a70a6846838a28990d3adfb2672ec0498479aa100d4e8f7fd81a14024
Opcode Fuzzy Hash: 79d3cb5a864bdc0b14ce0c9d731882356adca2f29bd61e5150b61395f1387a37
Instruction Fuzzy Hash: 8751F3B4D453589FCB40DFA9C480ACEBBF4BF89708F10852EE884AB345D771A945CB91

Function 5FD242D0 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FD2437A

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b27257fc5bc0d2708a789ac6699c2922fce86aafa6017dbbb9918677ba7350dc
Instruction ID: 97d009f98d2531f7b3e269b9bae04ae31c135d2dc07d08123c3ecba5af6a2159
Opcode Fuzzy Hash: b27257fc5bc0d2708a789ac6699c2922fce86aafa6017dbbb9918677ba7350dc
Instruction Fuzzy Hash: BD51F3B4D053589FCB40DFA4C480A9EBBF4BF9A708F10852EE884AB306D774A845CB91

Function 5FD24000 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 5FD240AA

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 12e918720c7e8f8cf4ac68f1b2b76384dcc3a72def7c1b8b6f01e6e5058f4593
Instruction ID: 4fdce6306d31f40f5e642dc6ca596a92c2be19b988373ef965d816a3e2c4e972
Opcode Fuzzy Hash: 12e918720c7e8f8cf4ac68f1b2b76384dcc3a72def7c1b8b6f01e6e5058f4593
Instruction Fuzzy Hash: EE51E3B8D05358DFCB40DFA5C580A9EBBF4BF9A308F10852EE844AB346D7759845CB91

Function 5FD245A0 Relevance: 2.7, APIs: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 6018DBF0: malloc.MSVCRT ref: 6018DC07

memcpy.MSVCRT ref: 5FD245FE
memcpy.MSVCRT ref: 5FD2464B

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: memcpy$malloc
String ID:
API String ID: 962570267-0
Opcode ID: 8443f56125083c51f94f1168ffaee58b85560c8aa668b5b4cf2f65c7d733277f
Instruction ID: 60235e948ea90543dd3837ec57d5d3a3568b6a4af8ef52c6e0c3eb530da7db23
Opcode Fuzzy Hash: 8443f56125083c51f94f1168ffaee58b85560c8aa668b5b4cf2f65c7d733277f
Instruction Fuzzy Hash: D76118B15093408FD740DF69C58035AFFE0BFAA348F114E5EE4C8A7661E7B59288CB92

Function 5FD23AE0 Relevance: 1.3, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48687267faecea6a7b786770cbeec31724db766fa69aab1ec5322c59f81d31f9
Instruction ID: c831e7e2fabe8ab4485375858caadcbd047e86cb291a40bf4ee78c73aa234a0a
Opcode Fuzzy Hash: 48687267faecea6a7b786770cbeec31724db766fa69aab1ec5322c59f81d31f9
Instruction Fuzzy Hash: 0D31DDB46093809FC3909F29C48034BBBE5BBD9758F508A1DF9D89B320D7B0E945CB92

Function 5FD23760 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578dac913a87140565fb5e1fe2579726b02b94776231f6b9c42837e57aaccc11
Instruction ID: 3f60285f46e287d0dc03ee738d550de6150c80fbd6e3a08a0da1f67ad8e98742
Opcode Fuzzy Hash: 578dac913a87140565fb5e1fe2579726b02b94776231f6b9c42837e57aaccc11
Instruction Fuzzy Hash: DC31C2B46087028FD701AF68C58572FBBE2AFA5248F019C2DF9C59B345DB74D9488F92

Function 5FD238C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69eb21136899658a4dfe9237e43069fad5832f9d7a41beae4120b01578682ceb
Instruction ID: 29d17366f5fdbaba9fe7791a99e8e3d7120a29c620931992d22e1bd83a47307c
Opcode Fuzzy Hash: 69eb21136899658a4dfe9237e43069fad5832f9d7a41beae4120b01578682ceb
Instruction Fuzzy Hash: 7431C0B4A097018FD701AF69C98571FBBE2AFA5248F014C2DF9845B345EB74DA488B92

Function 600EBEB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction ID: 2dc878b56fe1926962febb38ea475ef72852d101993c09b8e0c0e5503fb7f60c
Opcode Fuzzy Hash: 04fd1a9125bfd2236fb9ddb1cebcd5043b5ddcdea5d6fb7ae223072e2b11908c
Instruction Fuzzy Hash: ABC002B5C057408BD610BF38950A229BAB06B62209F856DACE58427255E73AC6189A5B

Function 600E9640 Relevance: 19.8, APIs: 13, Instructions: 272
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 600E9678
GetThreadTimes.KERNEL32 ref: 600E96A1
GetSystemTimeAsFileTime.KERNEL32 ref: 600E9717
QueryPerformanceFrequency.KERNEL32 ref: 600E9757
QueryPerformanceCounter.KERNEL32 ref: 600E976F
GetCurrentProcess.KERNEL32 ref: 600E9818
GetProcessTimes.KERNEL32 ref: 600E9841
_errno.MSVCRT ref: 600E9852

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: e2f3b6e125194667c19d3e7f5780a126fc8223f87b6e56733c91000477aa20dc
Instruction ID: 8815469ec616cd7d4fceed5ce6d34a7023428e43de4bf003c79d66cee1fff41c
Opcode Fuzzy Hash: e2f3b6e125194667c19d3e7f5780a126fc8223f87b6e56733c91000477aa20dc
Instruction Fuzzy Hash: 36B112B55083008FC701DF6AC98464ABFF5FF89355F058A2EE899A7324E774D944CB92

Function 600E54A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 600E54DD
CreateSemaphoreA.KERNEL32 ref: 600E551F
CreateSemaphoreA.KERNEL32 ref: 600E5546
InitializeCriticalSection.KERNEL32 ref: 600E5565
InitializeCriticalSection.KERNEL32 ref: 600E5570
InitializeCriticalSection.KERNEL32 ref: 600E557B

Strings

l, xrefs: 600E54CE

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: b87a819eb010998fb99ab447ef0515197c3b5e6eb35e97deb8e58984e3739c67
Instruction ID: 98c3bdbef643ce83e737de0bc075614b00230ccfa11c16bba5ff9c991ef034a9
Opcode Fuzzy Hash: b87a819eb010998fb99ab447ef0515197c3b5e6eb35e97deb8e58984e3739c67
Instruction Fuzzy Hash: D841BFB29043008FEB10AF29D94835ABFF4FF81315F118A6DD8A49B295E775D454CF82

Function 600EBB90 Relevance: 15.2, APIs: 10, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76be0989f39cfa2efb7634b0ee8f93a3cefcf0fcd66ca1f765f648971b9501bc
Instruction ID: 75cd61ab3e7a5bcba327cebaf8051e0ac3d25c7a16bd25003e08914e9a3606a6
Opcode Fuzzy Hash: 76be0989f39cfa2efb7634b0ee8f93a3cefcf0fcd66ca1f765f648971b9501bc
Instruction Fuzzy Hash: B971BD709483098FC701EFB9C48272EBBE5AFB2308F51481DE494A7365DB749A459FA3

Function 600E5620 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 201
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 600E7AC0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000030,76ECE820), ref: 600E7AD0

Part of subcall function 6003FE90: WaitForMultipleObjects.KERNEL32 ref: 6003FF03

ResetEvent.KERNEL32 ref: 600E569F

Part of subcall function 600E7E30: TlsGetValue.KERNEL32(?,?,00000000,?,600E8065,?,?,?,?,431BDE83,600E9B07), ref: 600E7E42

WaitForSingleObject.KERNEL32 ref: 600E56DF

Strings

(, xrefs: 600E576D

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: ValueWait$EventMultipleObjectObjectsResetSingle
String ID: (
API String ID: 2327612466-3887548279
Opcode ID: f43ed9fa60766f2535b561fe6f45ed87241cc72af970a281467394686eca0c05
Instruction ID: 8e63f30630ea833ae7947d4969b1341916dd59730c50ade57df93542cece519f
Opcode Fuzzy Hash: f43ed9fa60766f2535b561fe6f45ed87241cc72af970a281467394686eca0c05
Instruction Fuzzy Hash: 5461EE3890C311CFD711AF6BAA4531EBEE4AFA5746F500C2DE984B3251EA31CC548BA3

Function 5FDD7610 Relevance: 12.4, APIs: 3, Strings: 5, Instructions: 406
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 5FDD778A

Strings

, xrefs: 5FDD7C15
+, xrefs: 5FDD7BE8
, xrefs: 5FDD76EF
0123456789ABCDEF, xrefs: 5FDD76EA
0123456789abcdef, xrefs: 5FDD76F7

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: strlen
String ID: $ $+$0123456789ABCDEF$0123456789abcdef
API String ID: 39653677-2690344263
Opcode ID: 562877342ebff19b44322b62e610063b150340c7ab616b7cf3c733d2abbfce10
Instruction ID: 5abcfe8ac4becf1ec1d8dd1174c7bcc094fc10ca710b7a7c2c1475e3cb9bab75
Opcode Fuzzy Hash: 562877342ebff19b44322b62e610063b150340c7ab616b7cf3c733d2abbfce10
Instruction Fuzzy Hash: 210239B46093818FC794CF28C09075ABBE1BF89648F548DADF998DB351D775E940CB82

Function 5FDCFC10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToFiber.KERNEL32(?,?,?,?,5FD21CE1,5FD370E0,?,5FD3742C,?,?,?,?,?,?,?,?), ref: 5FDCFCB9
memcpy.MSVCRT(?,?,?,?,?,5FD21CE1,5FD370E0,?,5FD3742C,?,?,?,?,?,?,?), ref: 5FDCFD50
SwitchToFiber.KERNEL32(?,?,?,?,?,5FD21CE1,5FD370E0,?,5FD3742C,?,?,?,?,?,?,?), ref: 5FDCFD7C

Strings

`, xrefs: 5FDCFFFE

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: FiberSwitch$memcpy
String ID: `
API String ID: 148397844-2679148245
Opcode ID: 24accb1ecb98a7c587e9c3a85e0f480978ee7182867bef6de44dec4d60a7bbdb
Instruction ID: ab12f7c0d111144eeb153d661956aca5cfb92654e68710fd316b129ca077e6c8
Opcode Fuzzy Hash: 24accb1ecb98a7c587e9c3a85e0f480978ee7182867bef6de44dec4d60a7bbdb
Instruction Fuzzy Hash: CBD1E0F09097019FD740AFA4D59475AFBE4AF85384F01881EE8D89B345D7B4E884CBE2

Function 600E7E30 Relevance: 10.6, APIs: 7, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 600E6AD0: TlsAlloc.KERNEL32(?,?,00000000,600E801E,?,?,?,431BDE83,600E9B07), ref: 600E6B04

TlsGetValue.KERNEL32(?,?,00000000,?,600E8065,?,?,?,?,431BDE83,600E9B07), ref: 600E7E42

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: AllocValue
String ID:
API String ID: 1189806713-0
Opcode ID: 047214eca7c4074dde24b8696394c83f95db8e668e83895148d324ee0eb98906
Instruction ID: 389cad2e23e51e84ed704bb74ba9b4e7a3e539ca1d0f6b05eb39c0690074f811
Opcode Fuzzy Hash: 047214eca7c4074dde24b8696394c83f95db8e668e83895148d324ee0eb98906
Instruction Fuzzy Hash: E341B6716042114FDB01BF7EA88532A7FE5AF65258F110A79E999E7357EB30CC408792

Function 600E66E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 600E671E
OutputDebugStringA.KERNEL32 ref: 600E6743
abort.MSVCRT ref: 600E674C
fprintf.MSVCRT ref: 600E680C

Strings

5, xrefs: 600E6730

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabortfprintf
String ID: 5
API String ID: 4086887302-2226203566
Opcode ID: 110fe61611595884eae3c0bdfdf35a68f4a58b2a68b8d9f4fe7838a17bfd008d
Instruction ID: 20730b98303cd3e82b8a83d87a156f7101cc683c4b49f8ecd939c1ac82056357
Opcode Fuzzy Hash: 110fe61611595884eae3c0bdfdf35a68f4a58b2a68b8d9f4fe7838a17bfd008d
Instruction Fuzzy Hash: 38318FB18087019FCB11AF76D88575EBFF4BF65348F028A2DE598B7211E7709984CB92

Function 600E7BB0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 600E6B90: TlsGetValue.KERNEL32 ref: 600E6CD0

longjmp.MSVCRT ref: 600E7BE6
TlsGetValue.KERNEL32(?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE,?,?,?,00000000,?), ref: 600E7BF4
CloseHandle.KERNEL32(?,?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE,?,?,?,00000000), ref: 600E7C1B
_endthreadex.MSVCRT(?,?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE,?,?,?,00000000), ref: 600E7C30
CloseHandle.KERNEL32(?,?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE,?,?,?,00000000), ref: 600E7C42
TlsSetValue.KERNEL32(?,?,?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE), ref: 600E7C63
CloseHandle.KERNEL32(?,?,?,?,0000001C,600E7D9F,?,?,?,?,00000000,600E7EDE,?,?,?,00000000), ref: 600E7C7A

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 7321d87c280a7121c6935a6dd5f8e782c3a5d88116c811133101eaf330c0ab98
Instruction ID: e01d561fbb1268bd99f9590a18244030e167ddfc4fd02fb19947a0279997162d
Opcode Fuzzy Hash: 7321d87c280a7121c6935a6dd5f8e782c3a5d88116c811133101eaf330c0ab98
Instruction Fuzzy Hash: AD21ECB06047018FDB01AF35C9887167FF8EF29709F11486DE989EB266E734D840CB91

Function 6018DBF0 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6018DC07

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: d329a198d378bfa6feb9d731a8cacb5950a5312160c4e23ecc092d9a2b64d605
Instruction ID: 7cc428a6b9a04dae9dfb96500fe2c28e81cddce9a90ae63bf6dc4c94eb072d59
Opcode Fuzzy Hash: d329a198d378bfa6feb9d731a8cacb5950a5312160c4e23ecc092d9a2b64d605
Instruction Fuzzy Hash: CE212AB06083019FC700BFB9C48672EBBE4AF75318F41482DE4D89B256DBB489408F63

Function 5FDCF8F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

`, xrefs: 5FDCFB68
e, xrefs: 5FDCFB09

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID:
String ID: `$e
API String ID: 0-2074502723
Opcode ID: 92182cc05056ec55ab9dd468f7047b96401e4d80e677c380aaa854485a574aa2
Instruction ID: 828a80af0752195a9f1bc385b68ffab1be798e09291e9ea1cd215a3523ec3124
Opcode Fuzzy Hash: 92182cc05056ec55ab9dd468f7047b96401e4d80e677c380aaa854485a574aa2
Instruction Fuzzy Hash: FA71C8F090A3029BD740AFA5D59475EFBE4AF94784F01882DE4C89B341DBB9D484CBA2

Function 600E9E70 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 600E9E98
free.MSVCRT ref: 600E9F27
free.MSVCRT ref: 600E9F4F

Part of subcall function 600E54A0: calloc.MSVCRT ref: 600E54DD
Part of subcall function 600E54A0: CreateSemaphoreA.KERNEL32 ref: 600E551F
Part of subcall function 600E54A0: CreateSemaphoreA.KERNEL32 ref: 600E5546
Part of subcall function 600E54A0: InitializeCriticalSection.KERNEL32 ref: 600E5565
Part of subcall function 600E54A0: InitializeCriticalSection.KERNEL32 ref: 600E5570
Part of subcall function 600E54A0: InitializeCriticalSection.KERNEL32 ref: 600E557B

free.MSVCRT ref: 600E9F97

Strings

, xrefs: 600E9E89

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CriticalInitializeSectionfree$CreateSemaphorecalloc
String ID:
API String ID: 3430360044-3916222277
Opcode ID: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction ID: c6567531f6de664a66f5f828a031c7ed8d62f410dbdd25af92ae09aa663d0e82
Opcode Fuzzy Hash: 5e17245b14a16c47887db4d77e7442e1f41ca2bef3267d77ef55ec6c467aa379
Instruction Fuzzy Hash: 51313EB16093019FD3049F26E48535FFBE5EF95318F06882EE4889B356E376C849CB92

Function 600E9A40 Relevance: 6.2, APIs: 4, Instructions: 165timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 600E9A91
GetSystemTimeAsFileTime.KERNEL32 ref: 600E9B28
_errno.MSVCRT ref: 600E9BA7
_errno.MSVCRT ref: 600E9BE2

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: 7539fede6aeeed75b868000ebfe56e3c3bfb63d62e77278ac7877c1d17cc4b45
Instruction ID: db84d53a86e8ab66c2923d66f21d55863f89f84380e48ae86e88f5ede2f167ce
Opcode Fuzzy Hash: 7539fede6aeeed75b868000ebfe56e3c3bfb63d62e77278ac7877c1d17cc4b45
Instruction Fuzzy Hash: 1F5169726083048FC700DF2AD98470ABFE5FFD9314F658A2DE898A7364E770D9058B82

Function 600EBD40 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,600EBC17), ref: 6018F810
abort.MSVCRT(?,?,?,?,?,?,600EBB6C), ref: 6018F818
abort.MSVCRT(?,?,?,?,?,?,600EBC17), ref: 6018F82C
abort.MSVCRT(?,?,?,?,?,?,600EBC17), ref: 6018F844

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3a96e6545b1c46b67c72e114f781b3c28b144275557c3da0f88936422119e5a5
Instruction ID: 7d3b2821010b0d01db8186eb1c75e727239b1351ac75b616fb516857ea4a8552
Opcode Fuzzy Hash: 3a96e6545b1c46b67c72e114f781b3c28b144275557c3da0f88936422119e5a5
Instruction Fuzzy Hash: 6441E2716483098FC704DF69D481B9ABBE1FFE231CF14896DE0945B319D7319906DBA2

Function 6003FB30 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 6003FB60
GetTickCount.KERNEL32 ref: 6003FB6D
QueryPerformanceFrequency.KERNEL32 ref: 6003FBD7

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: PerformanceQuery$CountCounterFrequencyTick
String ID:
API String ID: 713402817-0
Opcode ID: 2364ef64273082fd1ba8cf8e516bb5660aabb9000298dc492ab4f40d04ac7054
Instruction ID: 57e7bf9e325d9b1a17682a757e6b448a7a52d6b026b932c10b379a6b8d5ee2bf
Opcode Fuzzy Hash: 2364ef64273082fd1ba8cf8e516bb5660aabb9000298dc492ab4f40d04ac7054
Instruction Fuzzy Hash: 1B3106B49083118FC705EF38C58461ABFE5BB99315F018A2CE89997364E734D849CF52

Function 5FE1BFC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 5FE1C058
strcpy.MSVCRT(?,?,?,?,?,?,5FD3C146), ref: 5FE1C089
strlen.MSVCRT ref: 5FE1C093

Strings

B, xrefs: 5FE1C01C

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: strlen$strcpy
String ID: B
API String ID: 2790333442-1255198513
Opcode ID: 54d31950d31bf75d8124eed05dd146b17fed716733eae6e8aa3c61cae9b500da
Instruction ID: 31ae26e93bd3b0076898946cbe1aa34b9bfb156a0d890d329122004f0802864d
Opcode Fuzzy Hash: 54d31950d31bf75d8124eed05dd146b17fed716733eae6e8aa3c61cae9b500da
Instruction Fuzzy Hash: 15214CF58097419FD700AF69C48479EBBE1FF80348F45486EE8889B202E779D4849B93

Function 6016A400 Relevance: 5.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6016A49E
memmove.MSVCRT(?,?,?,?,?,00000000,00000000,?,?,5FD27F62), ref: 6016A4BE
memset.MSVCRT ref: 6016A5B4

Part of subcall function 6018DBF0: malloc.MSVCRT ref: 6018DC07

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: memset$mallocmemmove
String ID:
API String ID: 1346079573-0
Opcode ID: 6606eabb0d41b8ddee3705f35de6be955ff2b78a866a6fadcceb703d12fd1160
Instruction ID: 3386462219de90d134375f75d181aa06d905b8b4978c39b17f262a0556aa7005
Opcode Fuzzy Hash: 6606eabb0d41b8ddee3705f35de6be955ff2b78a866a6fadcceb703d12fd1160
Instruction Fuzzy Hash: E35118B16087028FC304DF29D98061BFBE1AFE8754F15892EE8998B315DB31E945CF92

Function 600E5B50 Relevance: 5.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,?,600EA59B), ref: 600E5B96
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,?,600EA59B), ref: 600E5C26

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 24c04227735f66bc2fa87bcfdb511c69e181c55667db49c9953560b645de03c0
Instruction ID: 4423da5fd5462d706c7b7afc97fb8bf48ca91d006ae88f77899a1eaf95c7cb9c
Opcode Fuzzy Hash: 24c04227735f66bc2fa87bcfdb511c69e181c55667db49c9953560b645de03c0
Instruction Fuzzy Hash: 7B318EB55087008FDB04EF2AD8C475A7BE1FF54325F544969EC159F289E331E984CB92

Function 600E5900 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0000001C,00000030,00000050,?,600E5BD1), ref: 600E5920
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0000001C,00000030,00000050,?,600E5BD1), ref: 600E593C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,600E5BD1), ref: 600E5979
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,0000001C,00000030,00000050,?,600E5BD1), ref: 600E5985

Memory Dump Source

Source File: 00000009.00000002.1839065984.000000005FD21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 5FD20000, based on PE: true

Associated: 00000009.00000002.1839048095.000000005FD20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841163258.0000000060199000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.00000000601A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1841192165.000000006026E000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842090408.0000000060355000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842114490.0000000060356000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842138428.0000000060357000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1842163506.000000006035B000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5fd20000_rfusclient.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 747ee646184167911b15ba8d6bea19fdac78e090f588c236218082f331b4e464
Instruction ID: e6acd160b1b36b612d5df869e36c21181b786840d816d3f017a07e750c9b22ff
Opcode Fuzzy Hash: 747ee646184167911b15ba8d6bea19fdac78e090f588c236218082f331b4e464
Instruction Fuzzy Hash: 6711DAB5A087118FC701EF3AE98550ABBF4EF99761F01492DE98897311D231E8548B93

Analysis Process: rutserv.exePID: 7796, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	7

Executed Functions

Function 00829A60 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000000,?,00829B19,?,?,00829D58), ref: 00829AC6

Strings

gfff, xrefs: 00829A81
gfff, xrefs: 00829AAA

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: Sleep
String ID: gfff$gfff
API String ID: 3472027048-3084402119
Opcode ID: 5e46165e4fe12a0cb0b97d71fc4b3e4d7555812954f0bc1330c04744e8927540
Instruction ID: 60ad1bc2e8a3ee4eb6ff2259cacf6486ee8ca3400a22b25dabdd0aef9bd45b87
Opcode Fuzzy Hash: 5e46165e4fe12a0cb0b97d71fc4b3e4d7555812954f0bc1330c04744e8927540
Instruction Fuzzy Hash: 8F01A2717447348BDB6CA93DB88176C6282F781311FA48235E983CE2C9EAB198C08247

Function 00884F3C Relevance: 3.0, APIs: 2, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,008850E0,00000000,00020019,?), ref: 00884FB7
RegQueryValueExW.KERNELBASE(?,0088513C,00000000,00000000,00000000,?,00000000,008850CE), ref: 00884FE5

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000883000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00883000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_883000_rutserv.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 33e0d47f5b9e3fe3ef6c0649d0d184844c5c58ca2d07d596a5e563d1a97b3830
Instruction ID: c1947dcf2e67bc80fc573fa35053b5e1c59c005f77e4e27a636ce61a54c3017b
Opcode Fuzzy Hash: 33e0d47f5b9e3fe3ef6c0649d0d184844c5c58ca2d07d596a5e563d1a97b3830
Instruction Fuzzy Hash: E9114474B40B0CAFDB61EBA49D47B9A77A8FB05700F104465FE04E6281E6B49A848F91

Function 00D50658 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE(0000000A,00000000), ref: 00D5076A

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D50000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_rutserv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 267bbe90e89e13053b06a0291a43bae39e72396d9c801c73dd0803c6370e9e86
Instruction ID: 0217ad070c4411a11c55310d643adc33caafbfaafb2ef944a22bb8734e794cc5
Opcode Fuzzy Hash: 267bbe90e89e13053b06a0291a43bae39e72396d9c801c73dd0803c6370e9e86
Instruction Fuzzy Hash: E1413830A04204EFDF14DB68C981E9ABBE5EF89315F2944D4FC05AB292D770AE49DB64

Function 00D31034 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(?,?), ref: 00D310E7

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D31000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d31000_rutserv.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: c2da97425e5d4a6e859dd203e876b4c7d6b5812b30a902282db7e4e5de20f727
Instruction ID: 7f571d53b87ee46ce7d6405a80d984ac12a3affc51d297001b85ebcc1ea98ec6
Opcode Fuzzy Hash: c2da97425e5d4a6e859dd203e876b4c7d6b5812b30a902282db7e4e5de20f727
Instruction Fuzzy Hash: 4A219A74E0428A8FDB14DF79C8917ADBBF5EB4D300F188475E808EA246E73899448B75

Function 0082B190 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 0082B1EA

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ad9ec824ea67045439c33b53b5af0cb0b7457e0cef7ff46f7ae1e336fcf108e2
Instruction ID: 1d82f72126a3d9a07934de2bab667edd3aa7072e431891da0ef7563df1143958
Opcode Fuzzy Hash: ad9ec824ea67045439c33b53b5af0cb0b7457e0cef7ff46f7ae1e336fcf108e2
Instruction Fuzzy Hash: DD016272705264AFCB11DB9DA884B8AB7ECFB59320F148166F508DB381DB70DD5087A5

Function 0082B18E Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002158,00000000,?,?), ref: 0082B1EA

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 8bd15322f39ef3fa972de42f2238b17344d99c89ddbc27d5d4883d90d5d7730e
Instruction ID: 1c583c465c5c26946d425eb3259452eb88400accc3c204694e87e2736465552e
Opcode Fuzzy Hash: 8bd15322f39ef3fa972de42f2238b17344d99c89ddbc27d5d4883d90d5d7730e
Instruction Fuzzy Hash: 4DF04F72B05224AFD711CAADAC84A9AB7ECFB59360F144126F908E7380DB70ED5087A4

Function 0096BE64 Relevance: 1.5, APIs: 1, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0096BE84

Memory Dump Source

Source File: 00000010.00000002.3568167846.000000000096B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0096B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_96b000_rutserv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: eeed031f8d40bec7c316d0806381ed29ef85c229929ed22f000d502378a0d1ae
Instruction ID: 44968cae644dbcaac8c30fd0f9c0033d610c0951c97dc0ea5094731894273291
Opcode Fuzzy Hash: eeed031f8d40bec7c316d0806381ed29ef85c229929ed22f000d502378a0d1ae
Instruction Fuzzy Hash: C4F082601041809BDB25EBB8D4D17563BD9AF84314F08808AE444CF35BD723ECC4D763

Function 0082B734 Relevance: 1.5, APIs: 1, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysReAllocStringLen.OLEAUT32(?,?,?,0082AE29), ref: 0082B74E

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction ID: baad1a2a4b2992ef45846da25a55e5a529159332b5bdee2dbd08ac7f86eae9d3
Opcode Fuzzy Hash: 42b17b69e7c34a539a1e38d6f70af66ede4161eb92af256fead160cf4ab1be79
Instruction Fuzzy Hash: D8E012F45427219EEA14DA19B815B3B73ADFBD1302FA8C59CA801DB244DB35ACC0D779

Function 0096BF2A Relevance: 1.5, APIs: 1, Instructions: 19
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadPriority.KERNELBASE(?), ref: 0096BF41

Memory Dump Source

Source File: 00000010.00000002.3568167846.000000000096B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0096B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_96b000_rutserv.jbxd

Similarity

API ID: PriorityThread
String ID:
API String ID: 2383925036-0
Opcode ID: 736494e5836eb4f3d626e144a883415608e369882c642978f1bc1cc7b2f2e457
Instruction ID: 5a633fdf9efcc2bbd36e665c30cfd39bbbb8d6b015b536245136d7a7f540227a
Opcode Fuzzy Hash: 736494e5836eb4f3d626e144a883415608e369882c642978f1bc1cc7b2f2e457
Instruction Fuzzy Hash: 5ED0A9B27004281F8228E5ADA880DAA62CDDBCC2567208423F008C3210E625CC5043A0

Function 00D31218 Relevance: 1.5, APIs: 1, Instructions: 18
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000401,?,00000000), ref: 00D31230

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D31000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d31000_rutserv.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction ID: 0cf3d4fac840037bfd9e1c0d6276982dd058f17945f8f819bf586d44c561c44e
Opcode Fuzzy Hash: c40ac58bcbe592e67436c6c1658b3d70315458617669241c6911774ac0858f01
Instruction Fuzzy Hash: F3D05EB52002006FF71096A9D8CAF2177DCEB85714F4840A0FB0C8F293C5B5AC008374

Function 0082B498 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocStringLen.OLEAUT32(?,00000000,?,0082B5F3), ref: 0082B4A3

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction ID: ed08ec873dd2c689081d8b03cb2751c8bb8877ac4df624038af3130727d3a00c
Opcode Fuzzy Hash: 6a9c2ce9cc4a789dd8b7f56db604f782f191c8b2ddce53fb5c404305489610a8
Instruction Fuzzy Hash: 4EC08CFC18AB22ADFF093F35B905A3BA75CFD6130679000A8BD10CA102E735E8C0252A

Function 0082B208 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 0082B21D

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000829000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00829000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_829000_rutserv.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0090e549b2ea502e9a158c55c13b39a714d53e282923f423b291ac9308cf37e2
Instruction ID: 1c88ddd71d4afb6d84062820c7a2c7d8cc4a656aa2f33e9ea150900d760fe170
Opcode Fuzzy Hash: 0090e549b2ea502e9a158c55c13b39a714d53e282923f423b291ac9308cf37e2
Instruction Fuzzy Hash: 1BC092B12423208BC3207AF8BEDCB1932A8F708322F946824B206CE247C7BC88C4D754

Function 00D0859C Relevance: 1.4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IdThread (unknown), xrefs: 00D085B5

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D08000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d08000_rutserv.jbxd

Similarity

API ID:
String ID: IdThread (unknown)
API String ID: 0-2043411369
Opcode ID: 3a48e17b6b7f58792d0c0c53dd53541f5795817a75a5c0a0695d6fc4a35af167
Instruction ID: 9ff4a0540be9aa76c27488689f25de95e4cdc5f2b7e0fb462a49337fd2875db0
Opcode Fuzzy Hash: 3a48e17b6b7f58792d0c0c53dd53541f5795817a75a5c0a0695d6fc4a35af167
Instruction Fuzzy Hash: 7F419C30604244EFD712CF64C955A59BBF9FB4A710BA248A0F88497AA1CB71EE14FA60

Function 00D2C710 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

loopback, xrefs: 00D2C7D0

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D2C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D2C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d2c000_rutserv.jbxd

Similarity

API ID:
String ID: loopback
API String ID: 0-3546420730
Opcode ID: cdcfb7ff48c63bde279c1c173488dab0030a12a404ac0d2c7b2a48caa65e0158
Instruction ID: 108a04f557dcfdb67ffe60f2175407a8a12876d9e0575b684e1ba59f0c6b0a2b
Opcode Fuzzy Hash: cdcfb7ff48c63bde279c1c173488dab0030a12a404ac0d2c7b2a48caa65e0158
Instruction Fuzzy Hash: 68410774A14218AFDB10EF98E89199EBBF8FF58304B6485A5F804E7351D730EE40CB61

Function 017267B0 Relevance: 1.3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TProcessMessagesThread.Execute, xrefs: 017267BE

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001726000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01726000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1726000_rutserv.jbxd

Similarity

API ID:
String ID: TProcessMessagesThread.Execute
API String ID: 0-3632000192
Opcode ID: 05cb5a2965fd88e86cb0110e11f16da481eed05e4aca8b011c7723c0f5669fd3
Instruction ID: 67ba4e75830b2bcf518e26429a999604d02bfa481279cecf05d38d879117ae20
Opcode Fuzzy Hash: 05cb5a2965fd88e86cb0110e11f16da481eed05e4aca8b011c7723c0f5669fd3
Instruction Fuzzy Hash: 1E218CB4A04215EFD700EF68D981A89B7F5FB49724F2082A6F814DB3A1CA31ED01CB90

Function 00B03000 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000B03000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_b03000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268a419b04ea64c0ae1b98bbb2200776262d13de8dfcbf84f40fe074f5cb0723
Instruction ID: 5afd4fbc53cc9a0e36dc7b3bb77926129ded04dacfd81d0632a3eb16b72d9d91
Opcode Fuzzy Hash: 268a419b04ea64c0ae1b98bbb2200776262d13de8dfcbf84f40fe074f5cb0723
Instruction Fuzzy Hash: 04413D34A04244EFDB05CF68D895A9EBBF6FB49710F2185E5E815EB3A2D330AE41DB10

Function 01050A74 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001050000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1050000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88be5ac81e385e44fdddc14599aa948386c859eb81dc23e38f498266f7a178f3
Instruction ID: e3060038bb7d25e5bd8cff60406bc9c99ac7955a9b76c7e14a490837aae1d401
Opcode Fuzzy Hash: 88be5ac81e385e44fdddc14599aa948386c859eb81dc23e38f498266f7a178f3
Instruction Fuzzy Hash: 05316634604204EFE751CF68D895BAEBBF5EB4A704F2288E5F844DB652D730AE00CA21

Function 01050E78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001050000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1050000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f430aac285a5ccdabe5e32f50a2e0dbba5933fbbf9459ee7225095d42a37ca7f
Instruction ID: 144ed2cfb8e1fcb0c29cb929d802447c68b5052e6e66de4e04fffd208530ad8b
Opcode Fuzzy Hash: f430aac285a5ccdabe5e32f50a2e0dbba5933fbbf9459ee7225095d42a37ca7f
Instruction Fuzzy Hash: 4E21E238604209EFC740DF98C498D9AB7F5FF4A310B2581E5E845DB366DB31AD45CB41

Function 01050D60 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001050000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1050000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7058a1fa17ffe8d2700f38cc0b63a4703ec3b97b82ace2c99e352289de4e0244
Instruction ID: 487df177590b2fd43f8a250ae0d44746a84b83a44dea1dbdd881b5eba54b2cd8
Opcode Fuzzy Hash: 7058a1fa17ffe8d2700f38cc0b63a4703ec3b97b82ace2c99e352289de4e0244
Instruction Fuzzy Hash: 34113A303406418FD7A1EB3C8545B9EBBE0AF8A340F044499F9CACB316C731A8458761

Function 00D08D2C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D08000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d08000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction ID: 28a5dd22544cd488a2e5819e451a60d18c0dc7f2fe87c4940cf2ff3739f10347
Opcode Fuzzy Hash: 81948fb07ea46076df47939e4d292350c83f6c70c3d778978e75f0cd6fa9b20d
Instruction Fuzzy Hash: 04E06D73B006641BC210E25E6C42BA67B8AEBD57B0F1C4231FA88CB381D9635C5552B6

Function 01050E1A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001050000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1050000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407f8e87e328b70812a8a888e676370b5d2b33bcedd93808cceb1308f644b176
Instruction ID: e799d725a8af2601c1d70c4816d89f18d8682d8981a4f10e04d703b8f079e3eb
Opcode Fuzzy Hash: 407f8e87e328b70812a8a888e676370b5d2b33bcedd93808cceb1308f644b176
Instruction Fuzzy Hash: 3BE04F613417525AEBE0656D5DC177F45C8CB10B14F2801F9BEC6C5146C9A5CE446261

Function 00C9CF18 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000C9C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C9C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c9c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018aaf894cada2a007e0020aeeda0586ff99a2327b100c124d4c6361c912d7f7
Instruction ID: 0809057e669ba8dd639f5762e3ea8d8d1dcb442d0fb87cd76601d16713987242
Opcode Fuzzy Hash: 018aaf894cada2a007e0020aeeda0586ff99a2327b100c124d4c6361c912d7f7
Instruction Fuzzy Hash: 0CB02BB120C2006D351511414C83C366259C6C0F00F10800DF001C01005D910440A472

Function 00C9CF30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000C9C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C9C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c9c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c63bd9a12b92049ef76acd4fa76000c439bb6dbad457a426db26e6bdf56c70
Instruction ID: 6426017c98e53e98c3ea530d6a3301b0b6a32cb8e3f11f3d9d36a1458c58e2d3
Opcode Fuzzy Hash: 97c63bd9a12b92049ef76acd4fa76000c439bb6dbad457a426db26e6bdf56c70
Instruction Fuzzy Hash: 2AB09BB125D6006D751551555C87C366259D6C0F11F11851DF141C45445D955540A576

Function 01050E64 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001050000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1050000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction ID: 7b2920ddfe6f84631e7160ffd26f68e3fc5ad49f608786c8024c31f9b2b4dfa6
Opcode Fuzzy Hash: 276477d35d940d8837fbf1af46a8442e2ab0a5388a8a43947641e8f2f6b818c4
Instruction Fuzzy Hash: 4CC04870600204CFDB84AA68C9C9A463BF4AB4830972480A0A905CB2AAE7A0CC84DB40

Function 00C9CF03 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000C9C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C9C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c9c000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1bbdd8e6315309bb568eeb75a21429a810a32b778de78d3f535422074f8dc3
Instruction ID: 10a97b7537904a79f83903e3454d39f19f0c7e8420868bc1ab1201c7a7850309
Opcode Fuzzy Hash: 0c1bbdd8e6315309bb568eeb75a21429a810a32b778de78d3f535422074f8dc3
Instruction Fuzzy Hash: B7B0923220D7800DE62B23A428A2458BBA19D83610F1A05DEE0C08A6569E511082D692

Function 00D08C84 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D08000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d08000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction ID: 4f3cf1afa9ec0bea514cbc7b7b0d8d4315858afc08ff583551acedb0cdf694ce
Opcode Fuzzy Hash: ece824149a976f0be7aa823cfae3d6b3b8c5d121f86fed4468d886b46952911c
Instruction Fuzzy Hash: AEB0123200410C778F013E85DC01C597F1DAB90360B40C012F94C080219633B670A7D4

Function 00969AAA Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000969000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00969000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_969000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction ID: dcab931c4a539a2eadd99cff47283e157d11fd23f3196920210e5ae52d992c9a
Opcode Fuzzy Hash: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction Fuzzy Hash: 6BB001747001158F9F80DB28C688905B7E1BF8932131583E0A409CB336DA30EC85CF81

Function 00D09BBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D08000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d08000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction ID: a15d2f4b2a607d16273d958e79b877ecee0b3715d85dd5abd28ef4e8c3bd8baa
Opcode Fuzzy Hash: 478f410146413648341e8936528a27955cee7fad26bed8f5d055f4a05c08cb4c
Instruction Fuzzy Hash: 78A0017565905A8ECA05AB24C45AA54B3A4FA5430939580E5A0984A5629B2AA9068BA0

Non-executed Functions

Function 00D2C8E8 Relevance: 15.2, Strings: 12, Instructions: 159COMMON

Download Yara Rule

Strings

font-family: Courier New, monospace;, xrefs: 00D2C940
h1 {, xrefs: 00D2C968
</title>, xrefs: 00D2C922
background-color: #FFFFFF;, xrefs: 00D2C954
font-size: 130%;, xrefs: 00D2C972
textarea {, xrefs: 00D2C990
display: none;, xrefs: 00D2C99A
body {, xrefs: 00D2C936
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na, xrefs: 00D2C90F
margin: 0px 0px 0px 0px;, xrefs: 00D2C97C
<style type="text/css">, xrefs: 00D2C92C
font-size: 100%;, xrefs: 00D2C94A

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000D2C000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00D2C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d2c000_rutserv.jbxd

Similarity

API ID:
String ID: </title>$<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="copyright" content="TektonIT" /><meta na$<style type="text/css">$background-color: #FFFFFF;$body {$display: none;$font-family: Courier New, monospace;$font-size: 100%;$font-size: 130%;$h1 {$margin: 0px 0px 0px 0px;$textarea {
API String ID: 0-3743830688
Opcode ID: d5928497c75a4b9cee80ce7309e7fd7ea2fd073c7da92c48fbd6c885cc5ce0d5
Instruction ID: 9ad308de2657e7805f877af1e4f0b74f2fe33cf964c4431cea659e04df5dbb54
Opcode Fuzzy Hash: d5928497c75a4b9cee80ce7309e7fd7ea2fd073c7da92c48fbd6c885cc5ce0d5
Instruction Fuzzy Hash: B0412C22BF9B307E8201B514BD43E4F6E729AF8F4EE2039607014B2DC7A1E66D1C4079

Function 0172615C Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

show_duration_in_sec, xrefs: 01726264
error_code, xrefs: 0172622D
network_load, xrefs: 0172629B
ra_session_id, xrefs: 017261B4
closed_by_user, xrefs: 017261F6

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000001726000.00000020.00000001.01000000.0000000D.sdmp, Offset: 01726000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1726000_rutserv.jbxd

Similarity

API ID:
String ID: closed_by_user$error_code$network_load$ra_session_id$show_duration_in_sec
API String ID: 0-946321287
Opcode ID: 5db50c99d4557846a614860f78b9525b53b10d5100c6b8097dcc9dac6f6464c8
Instruction ID: c9c4a78467fed9dcea45425068a091b636af3d9b195b77de0a6ee01ec5ddf550
Opcode Fuzzy Hash: 5db50c99d4557846a614860f78b9525b53b10d5100c6b8097dcc9dac6f6464c8
Instruction Fuzzy Hash: B161C434A00219DFCB04EF98C5959DDBBB5FF49304F6045A9E801AB266DB70AE4ACF51

Function 00969594 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

INLINE, xrefs: 009695BC, 00969631
END, xrefs: 00969601, 0096965A
INHERITED, xrefs: 009695A8, 00969621
OBJECT, xrefs: 009695D2, 00969611

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000969000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00969000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_969000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 92f680a2844c424935099e471caf5d8d469ca1ec7779e0ec88ec9bd23badcc87
Instruction ID: 0c2083338aee5c3d156c9864f95fb539fcff86f81b6b956c01b8376760e886b2
Opcode Fuzzy Hash: 92f680a2844c424935099e471caf5d8d469ca1ec7779e0ec88ec9bd23badcc87
Instruction Fuzzy Hash: 5D2150742087049BDF20FFACC48179AB7DD9F99358B208555FD868B34ACA36DC068BA1

Function 00969593 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

INLINE, xrefs: 00969631
END, xrefs: 00969601, 0096965A
INHERITED, xrefs: 009695A8, 00969621
OBJECT, xrefs: 00969611

Memory Dump Source

Source File: 00000010.00000002.3568167846.0000000000969000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00969000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_969000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 017dfa3895f0f5c99a68f3f3c636fb586fd992c804d7ef0cef4eb681b3d58128
Instruction ID: 429e6070dcd72cc04446a3d6c796d9d5c8af1ea07801c25da70e9b9e03a97536
Opcode Fuzzy Hash: 017dfa3895f0f5c99a68f3f3c636fb586fd992c804d7ef0cef4eb681b3d58128
Instruction Fuzzy Hash: BA1151742083048FDF20EFACC88179AB7D9DF99398B208555FC859B35BCA36DC068B61

Analysis Process: rfusclient.exePID: 8092, Parent PID: 7796COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	2

Executed Functions

Function 00B4B6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(\\.\PIPE\RManFUSServerNotify32,40000000,00000003,00000000,00000003,00000000,00000000,00000000,00B4B75A), ref: 00B4B6ED
CloseHandle.KERNELBASE(000000FF,00B4B761), ref: 00B4B752

Strings

Error - CreateFile, xrefs: 00B4B6FB
\\.\PIPE\RManFUSServerNotify32, xrefs: 00B4B6E8
Error - NotifyServer - WriteFile, xrefs: 00B4B737

Memory Dump Source

Source File: 00000011.00000002.3568167016.0000000000B4B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b4b000_rfusclient.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: Error - CreateFile$Error - NotifyServer - WriteFile$\\.\PIPE\RManFUSServerNotify32
API String ID: 3498533004-2744967546
Opcode ID: b3f7d2bed66b01a65399847740f699a82a4550f46e341dc18450e96e9cab9e73
Instruction ID: 35e9c7c0a8f03074e4b2906bbca76205c68e74b8aa5dec62024666168f50dd4a
Opcode Fuzzy Hash: b3f7d2bed66b01a65399847740f699a82a4550f46e341dc18450e96e9cab9e73
Instruction Fuzzy Hash: A9113C75A40304BEDB11EBA89C42F59B7E8EB89720F2045A1FB10DB6D0D7709F00AB55

Function 005C383C Relevance: 1.6, APIs: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 005C392F

Memory Dump Source

Source File: 00000011.00000002.3568167016.00000000005C3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c3000_rfusclient.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction ID: 620982250ba2d4fb344b721b10e6d7a2555125cf86b53d717ea7468b601bbafd
Opcode Fuzzy Hash: f8689f47a30c8dc3a81985e1a6c86b74fb7905ddf96155da81c26318c978e409
Instruction Fuzzy Hash: 6321F8303443482DEB312DE91C06FBE9E95AF93F54F14C41DF5819B182DAF59E464222

Function 005C34A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 005C34D1

Memory Dump Source

Source File: 00000011.00000002.3568167016.00000000005C3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005C3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_5c3000_rfusclient.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction ID: 4675c5ed0c6662d926f105ec269df623bfca67809672c503009d219b72a780ae
Opcode Fuzzy Hash: 6d2c2957dbb299073f95a2d6050d4ab237cf5d545e63552985fa721db800645d
Instruction Fuzzy Hash: B5F0A0343001241FDF1BAA9884C9FEA6AD86F89704F0C80BAFE088F247C7659E468271

Function 00B4B75F Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(000000FF,00B4B761), ref: 00B4B752

Memory Dump Source

Source File: 00000011.00000002.3568167016.0000000000B4B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00B4B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_b4b000_rfusclient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction ID: b748c4baf5b706e7b631854199a22828b2038bf357279aa4ade7ad3fa18c9b9c
Opcode Fuzzy Hash: 236c79e1a1763148c4404337020ceded8e6837527dbd39c958730d13fa1e11c0
Instruction Fuzzy Hash: A9A00475544515FDC555D7D45555C5D7354554D3557341C41F303D5101C734DF407530

Function 003191E0 Relevance: .0, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3568167016.0000000000319000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00319000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_319000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584daae42aa3a8119b8123d979331827b921ac600ba65a586dc44f520e9e3eee
Instruction ID: 41d23be1322d52a0868b9cd7a264df6e5807f33eeb9e234906017101327d8485
Opcode Fuzzy Hash: 584daae42aa3a8119b8123d979331827b921ac600ba65a586dc44f520e9e3eee
Instruction Fuzzy Hash: 65E0C236B101350B9726A96D589028BA3D59EEC2A031A543AA840DB302C630DC4583D0

Function 0076BD74 Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3568167016.000000000076B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_76b000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb11c36ab23ad4d15190675ed53aa7b4d97d2fe0df9f2fb818686b393914b57
Instruction ID: 7c7bddd266dd2f61565ef78fe12bda201fdafdc020b1838089280dcf745bc3f0
Opcode Fuzzy Hash: 7fb11c36ab23ad4d15190675ed53aa7b4d97d2fe0df9f2fb818686b393914b57
Instruction Fuzzy Hash: 7CB092A165C2107D651B6210AC93C3A52A8DAC2B52F2C816FB842CD081AF811884A0BA

Function 0076BD5C Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3568167016.000000000076B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_76b000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cc7ae7104053b8db2f81845152644b615a1410ba058660ce3891c70facfb1f
Instruction ID: c938337df8f647a40f16cf713abb79e90a16511359dd095d6cb733c8dacad2ce
Opcode Fuzzy Hash: e7cc7ae7104053b8db2f81845152644b615a1410ba058660ce3891c70facfb1f
Instruction Fuzzy Hash: 71B092A164C2107D651B6210AD93C7A52A8CAC2B12F2C826EB842CD081AF811885A0BA

Analysis Process: rfusclient.exePID: 8140, Parent PID: 7796COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 007F5E68 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(007F5F28,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,007F5F1A), ref: 007F5E9C

Memory Dump Source

Source File: 00000012.00000002.3568175220.00000000007F5000.00000020.00000001.01000000.0000000B.sdmp, Offset: 007F5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7f5000_rfusclient.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bd96df63b652ded210e1d01aab23eb90a5149574e7d28d4fe70428b7ec477f4c
Instruction ID: 296ba72616c47601f910212cd80c4d89c37312bbcf38f87d91223207811eff49
Opcode Fuzzy Hash: bd96df63b652ded210e1d01aab23eb90a5149574e7d28d4fe70428b7ec477f4c
Instruction Fuzzy Hash: BB11E570644B08FFE7228BA4DC16F687BF4E709B20F610591F710AA7D0DB791A40C615

Function 0031AF00 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 0031AF5A

Memory Dump Source

Source File: 00000012.00000002.3568175220.000000000031A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0031A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_31a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 06a50a69973165c6ba64d981f6e8bfa54323956f95d7a6281c1ad13008d63f54
Instruction ID: 4731b722f528ae86fa2ded49f2c1b0f6932faa5e22691cc22aeaf9b1b6288505
Opcode Fuzzy Hash: 06a50a69973165c6ba64d981f6e8bfa54323956f95d7a6281c1ad13008d63f54
Instruction Fuzzy Hash: 60018472705614AFC715DB9DAC81ADAB7EC9B4C361F108026F508DB381DA70DD418765

Function 0031AEFE Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 0031AF5A

Memory Dump Source

Source File: 00000012.00000002.3568175220.000000000031A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0031A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_31a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 2f7284b9a2c486983fa26925b78a278ddaff9643db0b9e46bf6706d3ed215107
Instruction ID: 47a278032053d935068d2f31321e92c89ac3a06be8b0f5aa7196d97f2394016b
Opcode Fuzzy Hash: 2f7284b9a2c486983fa26925b78a278ddaff9643db0b9e46bf6706d3ed215107
Instruction Fuzzy Hash: 1AF0C872B05514AFC715CB9DAC80ADAB7ECDB4C361F104026F908D7380DA71DD81C7A4

Function 0031AF78 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 0031AF8D

Memory Dump Source

Source File: 00000012.00000002.3568175220.000000000031A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0031A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_31a000_rfusclient.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0e0ba4a0fe07b74ab09dbbc86052f9f56d672ac974787fb81935fa6467183025
Instruction ID: 0b87f5b3d4edd8e921c30d805d672a1557fb40f2b634a85a40dd1dab4637f6aa
Opcode Fuzzy Hash: 0e0ba4a0fe07b74ab09dbbc86052f9f56d672ac974787fb81935fa6467183025
Instruction Fuzzy Hash: 60C09BB1201B0087C32527749CCC7597758774D302F041824F10797162CB7C44D5C610

Function 00453DBC Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000453000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00453000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_453000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e5861e705039443da4c8859b5ae45f1a5248a41d08329e40dcbad131c13c8b
Instruction ID: 794664544d86fa8e7bc1064b4921b5702d9b31418052078253f4791100e13c28
Opcode Fuzzy Hash: f9e5861e705039443da4c8859b5ae45f1a5248a41d08329e40dcbad131c13c8b
Instruction Fuzzy Hash: AC310B709047549ED722DF75D8427EBBBE49F0D342F04CC2AE865CB682DB389648C755

Function 00453C26 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000453000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00453000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_453000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a0549f8484b5379c8e0cf8979354b4c33b8ec27383754d3bb9b87e1fb93787
Instruction ID: 4d2854c82f2a9e7eec88a44605ced23ee0c224c01ce1c1d3ce2e57ffc783fd0c
Opcode Fuzzy Hash: 21a0549f8484b5379c8e0cf8979354b4c33b8ec27383754d3bb9b87e1fb93787
Instruction Fuzzy Hash: B9118E71604644EFD706CF64C915959BBF4EB0A751F6244E2FC00AB312C734AE04DA64

Function 00453C28 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000453000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00453000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_453000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41783a8474670c9316c2b7c45c58607a8e87de0c711e294486be6b87ecc3fa24
Instruction ID: 1ef452f1a5d778fe2e00f61d3d760b850710f90a9ebf61a488ec39dc9a5382a5
Opcode Fuzzy Hash: 41783a8474670c9316c2b7c45c58607a8e87de0c711e294486be6b87ecc3fa24
Instruction Fuzzy Hash: 7E118B71608648EFD706CF64C915959BBF8EB0A752F6248E2F800AB312C738AE04DA64

Function 00627F48 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000627000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00627000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_627000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c118f18f2cbe81c46a7f8feb4622ddf06327b873c70b9af42154460e66621b
Instruction ID: 3ef50acde58013cf9239554a70f80e6d40d7055ed99cb548ea2c5d474f57393d
Opcode Fuzzy Hash: 03c118f18f2cbe81c46a7f8feb4622ddf06327b873c70b9af42154460e66621b
Instruction Fuzzy Hash: 0A114934600B04EFD711CF68D955FA9BBFAEB0A700F2244E4F8049B762CB75AD54EA21

Function 00453D20 Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000453000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00453000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_453000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction ID: f372d883d1935c49afcdf92cbbe51ea0960c025181ad43e49b85d7666e751d00
Opcode Fuzzy Hash: 599f5e932973f66a16ee734b73f26a54a60d76c27190859f49bffc15f9c6b975
Instruction Fuzzy Hash: 27D02E0270282043D116ABA90C827EA66688F45AE3F080132BC40CF3D6EA0A0E4C02EA

Function 006278B8 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.3568175220.0000000000627000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00627000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_627000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction ID: 97d5680196360c482314ada5dc164a026e7f5d9e0d0e99699adef6aee88ad5c7
Opcode Fuzzy Hash: 7f5fb9902847bde12a1817a2f9fd72b54f7da068455841462ae149435e8e5b14
Instruction Fuzzy Hash: ABB0123200010C778F013E92FC02C4A7F1DAB50364B00C012FD0C0C022963395B4A798

Input	Output
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " , \" \"", "prominent_button_name": "Got it", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " , \" \"", "prominent_button_name": "Got it", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 442.docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\440b42.rbs

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Windows Analysis Report
442.docx.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre