Edit tour

Windows Analysis Report
Kameta Setup 1.0.0.exe

Overview

General Information

Sample name:	Kameta Setup 1.0.0.exe
Analysis ID:	1568018
MD5:	0157b710ec82b63db471a4030979fbd3
SHA1:	03e1e97522f61193836a6f2b489699ba5b087b5e
SHA256:	4bcd67e69705a2aed00ecfb30e2e9f05af8a0e00d5cb787e8427d100f766ca54
Tags:	exemalicorduser-cyberclone
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Drops large PE files

Excessive usage of taskkill to terminate processes

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Kameta Setup 1.0.0.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\Kameta Setup 1.0.0.exe" MD5: 0157B710EC82B63DB471A4030979FBD3)

cmd.exe (PID: 6660 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KametaSetup.exe" | %SYSTEMROOT%\System32\find.exe "KametaSetup.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6820 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 6852 cmdline: C:\Windows\System32\find.exe "KametaSetup.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

KametaSetup.exe (PID: 1620 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" MD5: 7153F5DCF75B41969A641F98F370D035)

MpCmdRun.exe (PID: 6268 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3620 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7244 cmdline: wmic bios get smbiosbiosversion MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 3064 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7324 cmdline: taskkill /IM chrome.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7188 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7808 cmdline: taskkill /IM msedge.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7204 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7932 cmdline: taskkill /IM brave.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7252 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7892 cmdline: taskkill /IM firefox.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7280 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7872 cmdline: taskkill /IM opera.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7336 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7860 cmdline: taskkill /IM kometa.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7356 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7984 cmdline: taskkill /IM orbitum.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7376 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7792 cmdline: taskkill /IM centbrowser.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7416 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7800 cmdline: taskkill /IM 7star.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7436 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8144 cmdline: taskkill /IM sputnik.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7448 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8124 cmdline: taskkill /IM vivaldi.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7456 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8052 cmdline: taskkill /IM epicprivacybrowser.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 8704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7464 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7948 cmdline: taskkill /IM uran.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7552 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8188 cmdline: taskkill /IM yandex.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7624 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8116 cmdline: taskkill /IM iridium.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 8164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KametaSetup.exe (PID: 7960 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 7153F5DCF75B41969A641F98F370D035)

cmd.exe (PID: 8064 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8272 cmdline: tasklist /FI "IMAGENAME eq msedge.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8092 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8292 cmdline: tasklist /FI "IMAGENAME eq chrome.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6584 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8360 cmdline: tasklist /FI "IMAGENAME eq firefox.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

Conhost.exe (PID: 8312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3688 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8336 cmdline: tasklist /FI "IMAGENAME eq iexplore.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7520 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8428 cmdline: tasklist /FI "IMAGENAME eq iexplore.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8560 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8608 cmdline: wmic MemoryChip get /format:list MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

find.exe (PID: 8616 cmdline: find /i "Speed" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 8656 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8700 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8760 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8856 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)

KametaSetup.exe (PID: 8836 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 7153F5DCF75B41969A641F98F370D035)

cmd.exe (PID: 8944 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8992 cmdline: wmic bios get smbiosbiosversion MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 9080 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 9128 cmdline: wmic MemoryChip get /format:list MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

find.exe (PID: 9136 cmdline: find /i "Speed" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 9176 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6268 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7512 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3396 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1804 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7384 cmdline: taskkill /IM chrome.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 8716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8168 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7336 cmdline: taskkill /IM msedge.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 4088 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7528 cmdline: taskkill /IM brave.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7876 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7432 cmdline: taskkill /IM firefox.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6640 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7440 cmdline: taskkill /IM opera.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8228 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7472 cmdline: taskkill /IM kometa.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8108 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7632 cmdline: taskkill /IM orbitum.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1312 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8484 cmdline: taskkill /IM centbrowser.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6028 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8452 cmdline: taskkill /IM 7star.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2764 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8440 cmdline: taskkill /IM sputnik.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 8644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7496 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8472 cmdline: taskkill /IM vivaldi.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

Conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7848 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8096 cmdline: taskkill /IM epicprivacybrowser.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7676 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8084 cmdline: taskkill /IM uran.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7368 cmdline: taskkill /IM yandex.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7932 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8216 cmdline: taskkill /IM iridium.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7252 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6388 cmdline: tasklist /FI "IMAGENAME eq msedge.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7444 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7212 cmdline: tasklist /FI "IMAGENAME eq iexplore.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7356 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8428 cmdline: tasklist /FI "IMAGENAME eq iexplore.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7948 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7712 cmdline: tasklist /FI "IMAGENAME eq firefox.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7376 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8196 cmdline: tasklist /FI "IMAGENAME eq chrome.exe" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8220 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8772 cmdline: wmic bios get smbiosbiosversion MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

chrome.exe (PID: 8716 cmdline: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 9000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,14256643865995858684,9263389117564715630,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7332 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6644 cmdline: wmic MemoryChip get /format:list MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

find.exe (PID: 7928 cmdline: find /i "Speed" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7628 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8024 cmdline: taskkill /IM chrome.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7900 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4228 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7476 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8484 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 4340 cmdline: "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2072 --field-trial-handle=1972,i,2766285570963821738,1807897661508393279,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7952 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8152 cmdline: wmic bios get smbiosbiosversion MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7256 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 9136 cmdline: wmic MemoryChip get /format:list MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

find.exe (PID: 7540 cmdline: find /i "Speed" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

Conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8112 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7936 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

Conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1804 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8896 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 8976 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cmd.exe (PID: 8248 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 6268, StartAddress: 213032B0, TargetImage: C:\Program Files\Windows Defender\MpCmdRun.exe, TargetProcessId: 6268

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, CommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe, ParentProcessId: 1620, ParentProcessName: KametaSetup.exe, ProcessCommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, ProcessId: 8716, ProcessName: chrome.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName, CommandLine: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName, ProcessId: 8856, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Kameta Setup 1.0.0.exe

Virustotal: Detection: 7%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.0% probability

Source: Kameta Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7f8d2dd2-ffce-55a8-ade7-0b57674516b0

Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: Kameta Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: pdb_base = '%s.%s.pdb' % (pdb_base, TARGET_TYPE_EXT[target_dict['type']]) source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdb = self.GetPDBName(config, expand_special, output_name + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1874809314.0000000002D25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe\|dll).pdb' if 'product_name' is source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDatabaseFile': 'Flob.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe\|dll).pdb'. source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\registry-js\registry-js\build\Release\registry.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1823957007.0000000004F24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\APPDATA\\LOCAL\\NODE-GYP\\CACHE\\18.17.0\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\REGISTRY\WIN_DELAY_LOAD_HOOK.OBJ source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '$(IntDir)$(ProjectName)\\vc80.pdb', only_if_unset=True) source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDataBaseFileName': '$(IntDir)\\vc90b.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_cc = pdbpath + '.cc.pdb' source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_c = pdbpath + '.c.pdb' source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCMT.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1822603272.0000000004F23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\node-sqlite3\build\Release\node_sqlite3.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Kameta Setup 1.0.0.exe, 00000000.00000003.1822603272.0000000004F23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDataBaseFileName': '$(IntDir)vc90b.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868626155.0000000004F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\SRC" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\V8\INCLUDE" /I"..\NODE_MODULES\NODE-ADDON-API" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=registry /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=9 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\REGISTRY\\SRC\MAIN.OBJ" /Fd"RELEASE\OBJ\REGISTRY\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /wd4530 /wd4506 /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\SRC\MAIN.CC source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\win-version-info\win-version-info\build\Release\VersionInfo.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\SRC" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\V8\INCLUDE" /I"..\NODE_MODULES\NODE-ADDON-API" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=registry /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=9 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\REGISTRY\\" /Fd"RELEASE\OBJ\REGISTRY\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /wd4530 /wd4506 /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCPMT.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: # See comment at cc_command for why there's two .pdb files. source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1819905505.0000000005C30000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1816480721.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1816700083.00000000054F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 25MB

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 45.112.123.126 45.112.123.126

Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46
Source: unknown	TCP traffic detected without corresponding DNS query: 38.172.200.46

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: file.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1085
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1512
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1637
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1936
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2046
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2273
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2894
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2978
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3027
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3045
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3729
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3997
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4214
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4267
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4646
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/482
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5469
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5577
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036Frontend
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7527
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52560
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1874566297.0000000005236000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blogs.msdn.com/b/vcblog/archive/2010/04/21/quick-help-on-vs2010-custom-build-rule.aspx
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5752
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/576693/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/576694/.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/chromium/issues/detail?id=76293
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/issues/detail?id=111):
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/gyp/issues/detail?id=122
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1094869
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/110263
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1144207
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1171371
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181068
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/1181193
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/122592
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/142362.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/241769
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/241769.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/308366
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/333738.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/35878
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/403957
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/550292
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/565179
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642227
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642605
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/644669
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/650547
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/672380
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/709351
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/797243
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/809422
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/830046
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/849576
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/883276
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/927470
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.apple.com/library/mac/#documentation/DeveloperTools/Reference/XcodeBuildSettingRef/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/2/library/collections.html#collections.OrderedDict
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/troygoode/)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/cuFbX
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/dhPnp
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://maxao.free.fr/xcode-plugin-interface/specifications.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://primer.com
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://public.kitware.com/Bug/view.php?id=8392
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/1189781/using-make-dir-or-notdir-on-a-path-with-spaces
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/35817/whats-the-best-way-to-escape-ossystem-calls-in-python
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc2617#section-3
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868257136.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868257136.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cmake.org/Bug/view.php?id=6493
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cmake.org/pipermail/cmake/2010-July/038461.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.futurealoof.com)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/make/manual/make.html#Syntax-of-Functions
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html#tag_02_02
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.apple.com/source/cctools/cctools-809/misc/libtool.c
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1732210928.0000000005E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4674
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4849
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5140
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5536
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7405
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7763
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.izs.me)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blueoakcouncil.org/license/1.0.0
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3056
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=4118
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://choosealicense.com/licenses/mit/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1868871517.0000000002D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869107675.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=bg&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869620033.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869799271.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869867645.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869939214.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fa&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1871366307.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=pt-BR&category=theme81https://myactivity.google.com/myactivity
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1871947503.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ru&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sl&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872343570.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sr&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872458533.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sv&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872953595.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1873214356.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/feature/5463833265045504.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/feature/5463833265045504.Found
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/gyp/issues/detail?id=411
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1042393
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1046462
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1060012
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1091824
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1137851
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1300575
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/705865
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/710443
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/811661
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/848952
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/v8/7848
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dev.twitter.com/docs/auth/creating-signature
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dev.twitter.com/docs/auth/oauth
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://eslint.org/docs/rules/no-buffer-constructor)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org/opensource
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org/support
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Rob--W/proxy-from-env#readme
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Rob--W/proxy-from-env.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TroyGoode)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Yqnn/node-readdir-glob
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bagder/curl/blob/6beb0eee/lib/http.c#L710
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/bagder/curl/blob/master/lib/http_digest.c
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/braveg1rl/performance-now
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalker/safer-buffer#why-not-safe-buffer)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/desktop/registry-js#readme
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/desktop/registry-js.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dominictarr/rc.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/safe-buffer
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/hapijs/qs
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/iojs/io.js/pull/253#issuecomment-69432616
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/package-json-from-dist.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/path-scurry
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jonschlinkert)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jonschlinkert/normalize-path
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyeecheung/node-dep-codemod#dep005)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1874566297.0000000005236000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/node
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/node/commit/ccabd4a6fa8a6eb79d29bc3bbe9fe2b6531c2d8e
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/qs
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/qs.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/qs/graphs/contributors)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1874566297.0000000005236000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1874566297.0000000005236000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/queue-tick
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/queue-tick.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapbox/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapbox/node-pre-gyp/issues/119
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapbox/node-pre-gyp/issues/124
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mapnik/node-mapnik/issues/262
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/martine/ninja/blob/master/misc/ninja_syntax.py
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/punycode.js.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mikeal/oauth-sign
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-deprecated-api.md)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/node-inspector/v8-profiler/blob/master/package.json#L25
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/Release#release-schedule)).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-gyp/issues
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/3e7a14381497a3b73dda68d05b5130563cdab420/lib/os.js#L25-L43
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/master/CONTRIBUTING.md
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/master/doc/guides/contributing/pull-requests.md#commit-message-g
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/master/lib/internal/errors.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/blob/master/lib/internal/per_context/primordials.js
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/32887
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/35941
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/readable-stream
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/nopt.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/npm-bundled.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/npm-normalize-package-bin
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/npm-packlist.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/npm/pull/4887)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/npmlog.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/osenv
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/prebuild/node-gyp-build
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/prebuild/node-gyp-build.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/request/request.git
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/feross
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/isaacs
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vweevers/pe-coff
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vweevers/pe-machine-type
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vweevers/pe-machine-type-descriptor
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vweevers/pe-signature
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/vweevers/pe-signature-offset
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/dom.html#custom-data-attribute.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://izs.me)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lupomontero.com/)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lynx.invisible-island.net/lynx2.8.7/breakout/lynx_help/keystrokes/environments.html)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1874566297.0000000005236000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/punycode
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://no-color.org/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodei.co/npm/require-directory/)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/util.html#utilformatformat-args
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/util.html#utilinspectobject-options
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/docs/latest/api/fs.html#class-fsdirent
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.12.1/node-v18.12.1-headers.tar.gz
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.12.1/node-v18.12.1.tar.gz
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.12.1/node-v18.12.1.tar.gzhttps://nodejs.org/download/release
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.12.1/win-x64/node.lib
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://npm.taobao.org/mirrors/node-inspector/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://npmjs.org/package/require-directory))
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869939214.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868973610.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869041046.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873367206.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872343570.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869620033.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873696598.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869675577.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873875726.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://primer.com.Uporaba
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://robwu.nl/)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sourcemaps.info/spec.html
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://streams.spec.whatwg.org/#example-manual-write-with-backpressure
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1868871517.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869799271.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872736333.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870274413.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870883792.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870693300.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870210436.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871201394.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870822339.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869541186.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873130918.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873696598.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870339693.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869325429.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870481391.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871756252.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870641859.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869729983.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872831929.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871257948.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869675577.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/?p=block_warn
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1872953595.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872458533.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869107675.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872343570.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871947503.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873214356.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869620033.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871366307.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872584595.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870535530.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871006440.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869939214.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869867645.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868871517.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872736333.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870274413.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868973610.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870883792.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871139747.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870693300.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1869799271.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/security).
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/isntitvacant/status/1131094910923231232
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webassembly.github.io/spec/web-api
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.npmjs.com/package/npm-packlist
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.patreon.com/feross
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8288.html#section-3
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

Source: Conhost.exe	Process created: 111
Source: conhost.exe	Process created: 78
Source: cmd.exe	Process created: 124

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File dump: KametaSetup.exe.0.dr 162028032			Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File dump: KametaSetup.exe0.0.dr 162028032			Jump to dropped file

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_00404C9E	0_2_00404C9E

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Process token adjusted: Security

Jump to behavior

Source: libEGL.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: KametaSetup.exe0.0.dr	Static PE information: Number of sections : 16 > 10
Source: KametaSetup.exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: ffmpeg.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.0.dr	Static PE information: Number of sections : 11 > 10

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1868092159.0000000004F23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820501994.0000000006EC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8 vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1752338051.00000000069A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1868626155.0000000004F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1822603272.0000000004F23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1874809314.0000000002D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameElevate.exeH vs Kameta Setup 1.0.0.exe
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1830789369.000000000523E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8 vs Kameta Setup 1.0.0.exe

Source: Kameta Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sln_path = build_file_root + options.suffix + '.sln'
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sln_path = os.path.splitext(build_file)[0] + options.suffix + '.sln'
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: """Generate .sln and .vcproj files.
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: # GUID is the same whether it's included from base/base.sln or
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: # foo/bar/baz/baz.sln.

Source: classification engine

Classification label: mal88.troj.spyw.evad.winEXE@722/218@8/7

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8500:120:WilError_03
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Mutant created: \Sessions\1\BaseNamedObjects\7f8d2dd2-ffce-55a8-ade7-0b57674516b0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\nstB2D1.tmp

Jump to behavior

Source: Kameta Setup 1.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'KAMETASETUP.EXE'
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kometa.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "centbrowser.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "7star.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kometa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "opera.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "firefox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "brave.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "uran.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "orbitum.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "epicprivacybrowser.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "uran.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iridium.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "vivaldi.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sputnik.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "yandex.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "yandex.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'MSEDGE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'CHROME.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'FIREFOX.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "firefox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "opera.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "brave.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "vivaldi.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "brave.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "orbitum.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "uran.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "orbitum.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kometa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "centbrowser.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "7star.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sputnik.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "vivaldi.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "epicprivacybrowser.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "yandex.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "uran.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iridium.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'CHROME.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'FIREFOX.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'MSEDGE.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'IEXPLORE.EXE'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kometa.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Steam.exe")
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "centbrowser.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: Kameta Setup 1.0.0.exe

Virustotal: Detection: 7%

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

File read: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe "C:\Users\user\Desktop\Kameta Setup 1.0.0.exe"
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KametaSetup.exe" \| %SYSTEMROOT%\System32\find.exe "KametaSetup.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "KametaSetup.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,14256643865995858684,9263389117564715630,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2072 --field-trial-handle=1972,i,2766285570963821738,1807897661508393279,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\tasklist.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KametaSetup.exe" \| %SYSTEMROOT%\System32\find.exe "KametaSetup.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "KametaSetup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Section loaded: dwrite.dll

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7f8d2dd2-ffce-55a8-ade7-0b57674516b0

Jump to behavior

Source: Kameta Setup 1.0.0.exe

Static file information: File size 79764652 > 1048576

Source: Kameta Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: pdb_base = '%s.%s.pdb' % (pdb_base, TARGET_TYPE_EXT[target_dict['type']]) source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdb = self.GetPDBName(config, expand_special, output_name + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1874809314.0000000002D25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe\|dll).pdb' if 'product_name' is source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDatabaseFile': 'Flob.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe\|dll).pdb'. source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\registry-js\registry-js\build\Release\registry.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1823957007.0000000004F24000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /OUT:"C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.NODE" /INCREMENTAL:NO /NOLOGO KERNEL32.LIB USER32.LIB GDI32.LIB WINSPOOL.LIB COMDLG32.LIB ADVAPI32.LIB SHELL32.LIB OLE32.LIB OLEAUT32.LIB UUID.LIB ODBC32.LIB DELAYIMP.LIB "C:\\USERS\\ADMINISTRATOR\\APPDATA\\LOCAL\\NODE-GYP\\CACHE\\18.17.0\\X64\\NODE.LIB" DELAYIMP.LIB /DELAYLOAD:NODE.EXE /MANIFEST /MANIFESTUAC:"level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG /PDB:"C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\BUILD\RELEASE\REGISTRY.PDB" /OPT:REF /OPT:ICF /TLBID:1 /DYNAMICBASE /NXCOMPAT /MACHINE:X64 /LTCG:INCREMENTAL /ignore:4199 /DLL RELEASE\OBJ\REGISTRY\WIN_DELAY_LOAD_HOOK.OBJ source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '$(IntDir)$(ProjectName)\\vc80.pdb', only_if_unset=True) source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDataBaseFileName': '$(IntDir)\\vc90b.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_cc = pdbpath + '.cc.pdb' source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: pdbpath_c = pdbpath + '.c.pdb' source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCMT.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1822603272.0000000004F23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\node-sqlite3\build\Release\node_sqlite3.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: Kameta Setup 1.0.0.exe, 00000000.00000003.1822603272.0000000004F23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 'ProgramDataBaseFileName': '$(IntDir)vc90b.pdb', source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868626155.0000000004F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\SRC" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\V8\INCLUDE" /I"..\NODE_MODULES\NODE-ADDON-API" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=registry /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=9 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\REGISTRY\\SRC\MAIN.OBJ" /Fd"RELEASE\OBJ\REGISTRY\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /wd4530 /wd4506 /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\REGISTRY-JS\SRC\MAIN.CC source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBVCRUNTIME.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\win-version-info\win-version-info\build\Release\VersionInfo.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /c /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\INCLUDE\NODE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\SRC" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\CONFIG" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\OPENSSL\OPENSSL\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\UV\INCLUDE" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\ZLIB" /I"C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\NODE-GYP\CACHE\18.17.0\DEPS\V8\INCLUDE" /I"..\NODE_MODULES\NODE-ADDON-API" /Z7 /nologo /W3 /WX- /diagnostics:column /Ox /Ob2 /Oi /Ot /Oy /GL /D NODE_GYP_MODULE_NAME=registry /D USING_UV_SHARED=1 /D USING_V8_SHARED=1 /D V8_DEPRECATION_WARNINGS=1 /D V8_DEPRECATION_WARNINGS /D V8_IMMINENT_DEPRECATION_WARNINGS /D _GLIBCXX_USE_CXX11_ABI=1 /D WIN32 /D _CRT_SECURE_NO_DEPRECATE /D _CRT_NONSTDC_NO_DEPRECATE /D _HAS_EXCEPTIONS=0 /D OPENSSL_NO_PINSHARED /D OPENSSL_THREADS /D NAPI_VERSION=9 /D BUILDING_NODE_EXTENSION /D "HOST_BINARY=\"node.exe\"" /D _WINDLL /GF /Gm- /EHsc /MT /GS /Gy /fp:precise /Zc:wchar_t /Zc:forScope /Zc:inline /GR- /Fo"RELEASE\OBJ\REGISTRY\\" /Fd"RELEASE\OBJ\REGISTRY\VC143.PDB" /external:W3 /Gd /TP /wd4351 /wd4355 /wd4800 /wd4251 /wd4275 /wd4244 /wd4267 /wd4530 /wd4506 /FC /Zc:__cplusplus -std:c++17 C:\USERS\ADMINISTRATOR\DESKTOP\LEET STEALER\API\CRYPTER\SCRIPT\NODE_MODULES\NODE-GYP\SRC\WIN_DELAY_LOAD_HOOK.CC source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES\MICROSOFT VISUAL STUDIO\2022\PROFESSIONAL\VC\TOOLS\MSVC\14.42.34433\LIB\X64\LIBCPMT.AMD64.PDB source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: # See comment at cc_command for why there's two .pdb files. source: Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: Kameta Setup 1.0.0.exe, 00000000.00000003.1819905505.0000000005C30000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1816480721.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1816700083.00000000054F0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName

Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: KametaSetup.exe.0.dr	Static PE information: section name: .00cfg
Source: KametaSetup.exe.0.dr	Static PE information: section name: .gxfg
Source: KametaSetup.exe.0.dr	Static PE information: section name: .retplne
Source: KametaSetup.exe.0.dr	Static PE information: section name: .rodata
Source: KametaSetup.exe.0.dr	Static PE information: section name: .voltbl
Source: KametaSetup.exe.0.dr	Static PE information: section name: CPADinfo
Source: KametaSetup.exe.0.dr	Static PE information: section name: LZMADEC
Source: KametaSetup.exe.0.dr	Static PE information: section name: _RDATA
Source: KametaSetup.exe.0.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: KametaSetup.exe0.0.dr	Static PE information: section name: .00cfg
Source: KametaSetup.exe0.0.dr	Static PE information: section name: .gxfg
Source: KametaSetup.exe0.0.dr	Static PE information: section name: .retplne
Source: KametaSetup.exe0.0.dr	Static PE information: section name: .rodata
Source: KametaSetup.exe0.0.dr	Static PE information: section name: .voltbl
Source: KametaSetup.exe0.0.dr	Static PE information: section name: CPADinfo
Source: KametaSetup.exe0.0.dr	Static PE information: section name: LZMADEC
Source: KametaSetup.exe0.0.dr	Static PE information: section name: _RDATA
Source: KametaSetup.exe0.0.dr	Static PE information: section name: malloc_h
Source: b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node.6.dr	Static PE information: section name: _RDATA
Source: 4a9c2010-35c8-4393-942c-15e481873128.tmp.node.6.dr	Static PE information: section name: .didat
Source: 4a9c2010-35c8-4393-942c-15e481873128.tmp.node.6.dr	Static PE information: section name: .00cfg
Source: 4a9c2010-35c8-4393-942c-15e481873128.tmp.node.6.dr	Static PE information: section name: _RDATA
Source: 7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node.6.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\d343d789-d963-4936-b357-2cb8e482c52e.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\KametaSetup.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\d343d789-d963-4936-b357-2cb8e482c52e.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node	Jump to dropped file

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt			Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KametaSetup.lnk

Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\find.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\find.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3123
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2798
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3271
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 825
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2212
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1490
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3194

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\d343d789-d963-4936-b357-2cb8e482c52e.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8908	Thread sleep count: 3123 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8912	Thread sleep count: 2798 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8940	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 3271 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep count: 825 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1144	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8612	Thread sleep count: 2212 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8652	Thread sleep count: 1490 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8964	Thread sleep count: 3194 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8760	Thread sleep count: 221 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9008	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SMBIOSBIOSVersion FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs\unrealgame	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ADD tools/docker/architecture/linux-arm64/local/qemu-aarch64-static /usr/bin/qemu-aarch64-static
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1874941285.0000000002B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: en_NECVMWar&Prod_VMware_T
Source: Kameta Setup 1.0.0.exe, 00000000.00000002.1923696792.0000000000618000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cp -a "/usr/bin/qemu-${arch}-static" "${this_dir}/local"
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareTestX
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1823957007.0000000004F24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))
Source: Kameta Setup 1.0.0.exe, 00000000.00000003.1823957007.0000000004F24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

API call chain: ExitProcess graph end node

graph_0-3407

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KametaSetup.exe" \| %SYSTEMROOT%\System32\find.exe "KametaSetup.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "KametaSetup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq iexplore.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq firefox.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic bios get smbiosbiosversion
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic MemoryChip get /format:list
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Speed"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM msedge.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM brave.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM firefox.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM opera.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM kometa.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM orbitum.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM centbrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM 7star.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM sputnik.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM vivaldi.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM epicprivacybrowser.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM uran.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM yandex.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM iridium.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM chrome.exe /F

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "c:\users\user\appdata\local\programs\unrealgame\kametasetup.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "c:\users\user\appdata\local\programs\unrealgame\kametasetup.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "c:\users\user\appdata\local\programs\unrealgame\kametasetup.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Process created: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe "c:\users\user\appdata\local\programs\unrealgame\kametasetup.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Passwords VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\First Run VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\First Run VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\chrome_default_Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\all-files-Cy9pRN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\all-files-Cy9pRN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\all-files-Cy9pRN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\all-files.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0196354653 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0196354653 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0353475199 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0353475199 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0450125302 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0450125302 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0518291756 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0518291756 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0615447233 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0653671941 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0653671941 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0666563528 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1033868256 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1141274626 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1169381505 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1169381505 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1417002460 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1417002460 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1422339599 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265332024 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265465471 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2385760553 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3013890265 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3024948866 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3580751004 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3580751004 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3643399760 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3643399760 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3677062445 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3677062445 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4054640694 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4054640694 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4458179343 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4458179343 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4683256203 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4683256203 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4736274156 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5622580005 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6213653276 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6213653276 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6329227256 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6750529025 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7245361316 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7457734050 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8300215382 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8416181845 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8492240360 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8492240360 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8552718761 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8784112376 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9655434068 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9655434068 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-01-22-078.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Chromium_Cookies.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\edge_default_Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\edge_default_Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Low VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\symsrv.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\symsrv.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp3ED4.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp3ED4.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wct150C.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wct150C.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wct33D7.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wct3D66.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\Kameta Setup 1.0.0.exe

0_2_0040338F

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Extra Window Memory Injection	1 DLL Side-Loading	LSASS Memory	35 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Extra Window Memory Injection	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	11 Masquerading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	121 Virtualization/Sandbox Evasion	LSA Secrets	121 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Kameta Setup 1.0.0.exe	7%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\d343d789-d963-4936-b357-2cb8e482c52e.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\KametaSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsis7z.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
file.io	143.244.215.221	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
www.google.com	172.217.21.36	true	false	high
api.gofile.io	45.112.123.126	true	false	high
ntp.msn.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious
https://url.spec.whatwg.org/#concept-url-origin	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc6455#section-1.3	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://support.google.com/chrome/answer/6098869	Kameta Setup 1.0.0.exe, 00000000.00000003.1872953595.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872458533.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869107675.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872343570.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871947503.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1873214356.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869620033.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871366307.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872584595.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870535530.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871006440.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869939214.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1869867645.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868871517.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1872736333.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870274413.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1868973610.0000000002D23000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870883792.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1871139747.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1870693300.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/4633	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/Yqnn/node-readdir-glob	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://anglebug.com/7382	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://crbug.com/122592	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/pull/35941	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://console.spec.whatwg.org/#table	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://secure.travis-ci.org/troygoode/node-require-directory.png)	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
https://encoding.spec.whatwg.org/#textencoder	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://www.patreon.com/feross	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/tc39/proposal-weakrefs	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://goo.gl/t5IS6M).	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
http://crbug.com/110263	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://url.spec.whatwg.org/#concept-urlencoded-serializer	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/6929	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/jonschlinkert/normalize-path	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://nodejs.org/api/fs.html	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://npmjs.org/package/require-directory))	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/prebuild/node-gyp-build	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/pull/21313	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://anglebug.com/7246	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://anglebug.com/7369	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://anglebug.com/7489	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://primer.com.Uporaba	Kameta Setup 1.0.0.exe, 00000000.00000003.1872224054.0000000002D24000.00000004.00000020.00020000.00000000.sdmp	false
https://crbug.com/593024	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://www.midnight-commander.org/browser/lib/tty/key.c	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://nodejs.org/	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
http://www.squid-cache.org/Doc/config/half_closed_clients/	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://tc39.es/ecma262/#sec-timeclip	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity	Kameta Setup 1.0.0.exe, 00000000.00000003.1869620033.0000000002D23000.00000004.00000020.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://nodei.co/npm/require-directory/)	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
http://127.0.0.1	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://crbug.com/1300575	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/pull/33661	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/mathiasbynens/punycode.js.git	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://crbug.com/710443	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://narwhaljs.org)	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://code.google.com/p/gyp/issues/detail?id=411	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/readable-stream	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/WICG/scheduling-apis	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://crbug.com/1060012	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://localhosthttp://127.0.0.1object-src	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://code.google.com/p/chromium/issues/detail?id=25916	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/ljharb/qs.git	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
http://www.opensource.org/licenses/mit-license.php)	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/isaacs/path-scurry	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3997	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/4722	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://crbug.com/642605	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://twitter.com/intent/user?screen_name=troygoode)	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
http://crbug.com/333738.	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://fetch.spec.whatwg.org/#fetch-timing-info	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/1452	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://webassembly.github.io/spec/web-api	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/pull/12607	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecma-international.org/ecma-262/#sec-line-terminators	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/joyeecheung/node-dep-codemod#dep005)	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node-gyp/issues	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://crbug.com/650547callClearTwiceUsing	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://blueoakcouncil.org/license/1.0.0	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3502	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3623	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3625	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3624	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://www.unicode.org/copyright.html	Kameta Setup 1.0.0.exe, 00000000.00000003.1732210928.0000000005E30000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/npm/npm-normalize-package-bin	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/2894	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3862	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
http://crbug.com/241769	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://nodejs.org/api/util.html#utilinspectobject-options	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/4836	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://heycam.github.io/webidl/#es-iterable-entries	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://heycam.github.io/webidl/#es-interfaces	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/mapnik/node-mapnik/issues/262	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/issues	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://url.spec.whatwg.org/#urlsearchparams	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/sponsors/isaacs	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	false
https://infra.spec.whatwg.org/#ascii-whitespace	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
http://anglebug.com/3970	Kameta Setup 1.0.0.exe, 00000000.00000003.1820252389.0000000006980000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/desktop/registry-js.git	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://heycam.github.io/webidl/#Replaceable	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/mikeal/oauth-sign	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://streams.spec.whatwg.org/#example-manual-write-with-backpressure	Kameta Setup 1.0.0.exe, 00000000.00000003.1747865157.0000000005130000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/nodejs/node/pull/30380#issuecomment-552948364	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/sponsors/feross	Kameta Setup 1.0.0.exe, 00000000.00000003.1748125825.00000000059F2000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748395496.0000000006840000.00000004.00001000.00020000.00000000.sdmp, Kameta Setup 1.0.0.exe, 00000000.00000003.1748589484.0000000006C40000.00000004.00001000.00020000.00000000.sdmp	false
https://heycam.github.io/webidl/#dfn-class-string	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	Kameta Setup 1.0.0.exe, 00000000.00000003.1820773785.00000000074A8000.00000004.00001000.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
143.244.215.221	file.io	United States	174	COGENT-174US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
38.172.200.46	unknown	United States	174	COGENT-174US	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568018
Start date and time:	2024-12-04 06:31:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	324
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Kameta Setup 1.0.0.exe
Detection:	MAL
Classification:	mal88.troj.spyw.evad.winEXE@722/218@8/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.165.84, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 172.217.19.238, 13.107.6.158, 13.87.96.169, 172.217.165.131
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, clients2.google.com, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, prod-agic-us-1.uksouth.cloudapp.azure.com, otelrules.azureedge.net, a-0003.a-msedge.net, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, business.bing.com, clients.l.google.com, dual-a-0036.a-msedge.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateNamedPipeFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:32:14	API Interceptor	11x Sleep call for process: Kameta Setup 1.0.0.exe modified
00:32:26	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
00:32:29	API Interceptor	12x Sleep call for process: WMIC.exe modified
00:32:36	API Interceptor	20x Sleep call for process: powershell.exe modified
00:32:48	API Interceptor	1x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://gaajbai.r.tsp1-brevo.net/tr/cl/Ipv8tLM_6XFaC46-AyySv62xU11Gam_6wBo9PhTW-GrEoJin-pUABRxsrn3Ohs7KWpubjNC13uikhD3jyVC-cicv7bjCnB_FKR8ntrSWj62GHX8lS9bF6DjFTod72jGT5orFYUcuEZfFLhYH0PJw3YcV5REfPqGJ30gJCwxSfXvPcvLXBVOydAdUyQvhvO7-TVZ6o3kdYYQkVDMJ3dx52jV6Fez8X6pInuPyzqbRfl7bceqY4dWENNeM8e3cXfQsiIiS3GOEtSEu79PK1qkXINb6	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://www.bing.com/ck/a?!&&p=b3ddcc612c5f63024f18df0521265aa33742187d0b01744f07bf6348af8f753eJmltdHM9MTczMzE4NDAwMA&ptn=3&ver=2&hsh=4&fclid=26e9525e-8a77-6109-2437-46988be9608d&psq=superpitmachinery.com&u=a1aHR0cHM6Ly9zdXBlcnBpdG1hY2hpbmVyeS5jb20v&ntb/#fi-weixiang.ong@falconincorporation.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	Invoice268277.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	QuarantineMessage (1).zip	Get hash	malicious	HTMLPhisher	Browse
143.244.215.221	iDvmIRCPBw.exe	Get hash	malicious	Unknown	Browse
	ZdXUGLQpoL.exe	Get hash	malicious	Unknown	Browse
	jaPB8q3WL1.exe	Get hash	malicious	Unknown	Browse
	00514DIRyT.exe	Get hash	malicious	GO Stealer	Browse
45.112.123.126	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.gofile.io	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	45.112.123.126
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
chrome.cloudflare-dns.com	ton.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	172.64.41.3
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
file.io	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	31.14.70.244
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://gaajbai.r.tsp1-brevo.net/tr/cl/Ipv8tLM_6XFaC46-AyySv62xU11Gam_6wBo9PhTW-GrEoJin-pUABRxsrn3Ohs7KWpubjNC13uikhD3jyVC-cicv7bjCnB_FKR8ntrSWj62GHX8lS9bF6DjFTod72jGT5orFYUcuEZfFLhYH0PJw3YcV5REfPqGJ30gJCwxSfXvPcvLXBVOydAdUyQvhvO7-TVZ6o3kdYYQkVDMJ3dx52jV6Fez8X6pInuPyzqbRfl7bceqY4dWENNeM8e3cXfQsiIiS3GOEtSEu79PK1qkXINb6	Get hash	malicious	Unknown	Browse	44.240.133.238
	mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.bing.com/ck/a?!&&p=b3ddcc612c5f63024f18df0521265aa33742187d0b01744f07bf6348af8f753eJmltdHM9MTczMzE4NDAwMA&ptn=3&ver=2&hsh=4&fclid=26e9525e-8a77-6109-2437-46988be9608d&psq=superpitmachinery.com&u=a1aHR0cHM6Ly9zdXBlcnBpdG1hY2hpbmVyeS5jb20v&ntb/#fi-weixiang.ong@falconincorporation.com	Get hash	malicious	Unknown	Browse	13.227.8.65
	ft.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.50
	https://payroll-news.at-eu.therelayservice.com/service/BUX_ZozoSdJWCG_5j9jtL5kIM8s4zpz8F8daQ7vEahL5WDRxV7IghpJPwSaoWNEG9eO6H06U_y_gwUSZJc9fDfwYBqPUPrZdmmRzUZ9qHFiMcq2w4-i7crrAjeyo_fa156_U7Eu0Ww9PKs3fM5eYkKQ_3vneF9YQUPUya3C3-wlq3FWHKATIkpuQEfV3laRldFNeWNfYS-sS9ogrADD3n54QIIqJd8nlTvWUjJCrpgug-gBImSGXyayDT39pkqjgqB_40YKcUcppFI95cuu7iPqdT0iDrU2CjdVlbNBd7udGztDhsYo1On9eJe-8oAEXs4eUbwt4py8g4aPFRtdg8AUlv-D-xKGeqkuRGN01AKHTOx7qZI-nNi5aqPk4UOXYeA3nx4xY22_7T29dLhfKcA	Get hash	malicious	Unknown	Browse	52.217.140.2
	most-x86_64.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	teste.arm5.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	54.103.237.20
	teste.m68k.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	18.152.233.140
	teste.sh4.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	13.57.193.182
	teste.x86_64.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	18.140.235.228
COGENT-174US	x86.elf	Get hash	malicious	Mirai	Browse	206.0.212.27
	teste.arm5.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	38.31.207.148
	teste.m68k.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	38.177.208.149
	teste.x86_64.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	206.234.73.160
	teste.mips.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	38.217.51.209
	teste.ppc.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	149.127.172.184
	teste.mpsl.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	167.141.205.46
	m68k.elf	Get hash	malicious	Mirai	Browse	38.220.172.164
	sh4.elf	Get hash	malicious	Mirai	Browse	38.154.20.156
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	38.230.71.227

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8307
Entropy (8bit):	5.793720174092154
Encrypted:	false
SSDEEP:	192:fsNAm0sbVeiRUDFQekakT6qRAq1k8SPxVLZ7VTiQ:fsNAZsBEataw6q3QxVNZTiQ
MD5:	FD66EB2BFD96B03E5D097CAA045B356E
SHA1:	6B84DE85A2C3563268000792D05C0E866BA29214
SHA-256:	9220A4A3951C4350132BE56D84F5536813E2E74AD4DC0420337182ADEF900EE1
SHA-512:	27B26C80E003DB2B3A2D4BF6991E6BA1DEA699752FD6DD7D387CFE6736E017AEA4AB0C5237FD527F50FD797E1115E0872A2B3475D219B620A69847633EEB4219
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50c15ad4-c3c9-4922-9f5f-356837788599.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8389
Entropy (8bit):	5.787675957011341
Encrypted:	false
SSDEEP:	192:fsNwm0sbVeiRUWFQekakT6qRAq1k8SPxVLZ7VTiQ:fsNwZsBLataw6q3QxVNZTiQ
MD5:	CAD5B74165A38F9FB0C6DE726872AE89
SHA1:	631C4B9632272A1E8FC5880FF7A2F72374B4ADC0
SHA-256:	88AF1C48192BA0965095FBD41A41F58543F72AE536DD221AD1722287198F1166
SHA-512:	3BB6ADD6ACA02242D7A7B7DD533D65C2F17C292F42669532B6FA85B16EFE00F765BB4F76C0000CB13272EB28DD878AFA22B8541D975A29E52BBCA6DC6622CF87
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\611a4120-f6b2-46a7-bbe5-d3a05ebc0f5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794003621625986
Encrypted:	false
SSDEEP:	192:akm0sbLeiRUJh16qRAq1k8SPxVLZ7VTiq:akZs7c16q3QxVNZTiq
MD5:	279D717037CE121916CB6ED78613BA9F
SHA1:	21E84B21D7BED02559A57315C92957FBAF3DE9CE
SHA-256:	2534CA244AE77F5ECA9AB4B0FF4C47DFB1CFE4FC3DBBE18E070EE591BCF49175
SHA-512:	D3BC6A1B25171C8459B6C70594E86509D4E29CC323117784B1A4C94698F868CDA4DD3AB846CF361D3877ABA5EF1496D698E6DFD4D3C5051D486573830F6B5C9F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADcH/FMRTSN/GAQnHWOJ2rMPf+/om00Ja0Hrz+xwyA4qgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674FE97B-10F4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.24409624828003282
Encrypted:	false
SSDEEP:	1536:tyPJI6oLgkgRGNRGFEYsvXteikWFWhOoZKbz/Wj:tyRIjLgkgRGS6YsvXtenWgZKbz/Wj
MD5:	26289C57B1071FF5A342DCC76EA1D8D0
SHA1:	C86320B3CE03FE33D5A0164EDC2CAF0546CCFAD2
SHA-256:	DC6F14440CF27109B7034B4ACEE81F7FE0435E3F80849C33C80B26B5E08EE74D
SHA-512:	C53FD4C0EBF5DA539632A69354A7883C2D4FFB47AFF7082F35C381285E4D11E18E3810BC00F6A8FB7BD5803AF73B97814C93FF387CCDA6C549044AF12EAEEFA0
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................T...T..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....y.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".xkrfjf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./........................<.w..U'D.I..G...W6.....>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....trig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7848956527006603
Encrypted:	false
SSDEEP:	3:FiWWltl/9U1i2RRIxINXj1C:o1/R2Yq2
MD5:	C48FB0C839F52094E5B7ED752859BB4F
SHA1:	D7863FA68E45C3432E10236A977708A44E300FAB
SHA-256:	EFFCFFAA8C3AE23BC6BBBF20BEFC538BCE1C6641096837F63E94124D5794FB1B
SHA-512:	16AB8BA83EF97293FA75C34EC1C40CB53408159B201A57B2FA2185EE66B21F9708CFA289B9CF3413253BAB4AE7E9700C3469CDCBA03672992077BA8BB22EF641
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................5.y&.K.?....................................................................................................................................................................................................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\68ac5585-ab26-4d82-b0ef-61a83891f1c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlHZ/l:Ls35/l
MD5:	1B60B7BDC9807EE62E7795A49FC5C9D0
SHA1:	CAFFC489E99DBDA3581967A79FD9CF0E07FA2101
SHA-256:	1362DF5374FF3CEC8A8A95C1F4B265C7E95CF8F8C762BBE4B2E9A1B9C27E8CCF
SHA-512:	69FDCF3C55C27C6FD9371C27C7B20AAD78BB4D92842E4F76512C76720BCCC89C8EB7E9783BA57245D0DA78C5327444F417512F78C984F8F6ADE2E123A04D09FA
Malicious:	false
Reputation:	unknown
Preview:	........................................Qk.d../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.162426824766622
Encrypted:	false
SSDEEP:	6:j/ORM1wkn23oH+TcwtnG2tbB2KLlJ/nBvq2Pwkn23oH+TcwtnG2tMsIFUv:7ORrfYebn9VFLjBvvYfYebn9GFUv
MD5:	B49010E3DA7E65F24D26E109E4C99B36
SHA1:	0F0246E6AAF6C82EBFAEC1B41BF1E65379E70CA5
SHA-256:	DAF8F7B89F05287033CA106FF434475F54884EA8A2D3BB556BE6F7CE7753C005
SHA-512:	EDC6FB1523B13C4923CD2EEDBD8AF9E9D925715430D3ECD4EA277F6D7CCA624484A0C68472B093E1C0AE725F245A0F625CF2331BC24F89F9ACF8769996C1AA68
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.335 1e24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/12/04-00:32:44.365 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.094016733065257
Encrypted:	false
SSDEEP:	6:j/BDRoM1wkn23oH+Tcwt8aVdg2KLlJ/GFIq2Pwkn23oH+Tcwt8aPrqIFUv:7BDSrfYeb0LjGOvYfYebL3FUv
MD5:	5801E913E4F69D379877485DF0B3FC63
SHA1:	F9DB956BA5495FA1C99096101DAD8101308E5839
SHA-256:	64E01EE45F5C1BEC4F8FC83357EF2D4CFE777FA219D4F3272D519D16906A46CA
SHA-512:	F70B596D910FEC408970CC6E7927A6F464B53789BA948D76650DE9130F6D72A50758ACFA1D07640B8400EA0767C7A0E6A22CD6B91B5BB05F3582EEDAD4EF873E
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.270 23a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/12/04-00:32:44.448 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.095450517663594
Encrypted:	false
SSDEEP:	6:j/aM1wkn23oH+Tcwt86FB2KLlJ/w4q2Pwkn23oH+Tcwt865IFUv:7arfYeb/FFLjw4vYfYeb/WFUv
MD5:	4D1B8FA69DF40BD3045B3E0A3B5861D7
SHA1:	4933521222544BE69A7E168C807B2B6D98983A1C
SHA-256:	1982BB72CD82927D7A3DF37D04923C39D732967EF0789A03EA8F02F929854451
SHA-512:	E18AB8B742F938A5957DF8159727A9C538D42A22897BC801F04C674B70A43CE5C778D021D75016D42438EA869CC31BDB4488F9EC7263237945255823C4CC17FA
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.449 23a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/12/04-00:32:44.495 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	F5DB9E03121BAEFA935729AECA8F9B25
SHA1:	566AB4BEA20FCA1E5DC02458820EDEAB0D089FCE
SHA-256:	6AF84BCBACC6188E9DC569332B289BA93FE5495124E53D7C2213F43CE23C51D6
SHA-512:	A3B7DC9910A812BE90F789C257FDAAA35D04DD418FDB9C9FAD8E4E28C5D311DAC744CD64D16E9681554213FFD0CF9815EC24CF7E0BE4D78CE93C9AF27F6CFB20
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.113382580632903
Encrypted:	false
SSDEEP:	6:j/yFTAq2Pwkn23oH+Tcwt8NIFUt8m/yFThZmw+m/T7kwOwkn23oH+Tcwt8+eLJ:7ypAvYfYebpFUt82yph/+2T75JfYebqJ
MD5:	B1DE06B2F3EC9ECEF5D1F33E1F112F01
SHA1:	1E583E51DDE29CDCD95C1C7A02185E353C4999F6
SHA-256:	495D8C3D0EADE764991543CAD52A316CC5E87705435BA9C19F6E0A752B2D274F
SHA-512:	E1F150D8F2C8F952E33D9899706C5720A19C134AE3D6498C68E983D7E4586311F78627BA9EBC2DD0D4A30397E6408B0FEE5DCDF32BFDC63DFFE86996148BA9C7
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.954 2060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/04-00:32:44.954 2060 Recovering log #3.2024/12/04-00:32:44.955 2060 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.113382580632903
Encrypted:	false
SSDEEP:	6:j/yFTAq2Pwkn23oH+Tcwt8NIFUt8m/yFThZmw+m/T7kwOwkn23oH+Tcwt8+eLJ:7ypAvYfYebpFUt82yph/+2T75JfYebqJ
MD5:	B1DE06B2F3EC9ECEF5D1F33E1F112F01
SHA1:	1E583E51DDE29CDCD95C1C7A02185E353C4999F6
SHA-256:	495D8C3D0EADE764991543CAD52A316CC5E87705435BA9C19F6E0A752B2D274F
SHA-512:	E1F150D8F2C8F952E33D9899706C5720A19C134AE3D6498C68E983D7E4586311F78627BA9EBC2DD0D4A30397E6408B0FEE5DCDF32BFDC63DFFE86996148BA9C7
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.954 2060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/04-00:32:44.954 2060 Recovering log #3.2024/12/04-00:32:44.955 2060 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.199881629918119
Encrypted:	false
SSDEEP:	12:758+vYfYeb8rcHEZrELFUt825rCX/+25rC3V5JfYeb8rcHEZrEZSJ:XYfYeb8nZrExg8KJfYeb8nZrEZe
MD5:	791F583001AFB8CD790F2DF8C0484EE4
SHA1:	8204E7CFBE28708022715744DBB14C6716B22DC8
SHA-256:	174FD8949F7F6D4FAC00A2A4085EB109620E9E273F6879ADE1B826F9ACAFE3BD
SHA-512:	00FC68F875598C04C388D52DF5AE40DF3C019D387BC748DFD3D1779E1D8C0A0C7A035346C9EEB241DB2E41A34E53FBCE10F7A9F983100E4D952B503E79FDFFD5
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:46.072 204c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/04-00:32:46.074 204c Recovering log #3.2024/12/04-00:32:46.074 204c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.199881629918119
Encrypted:	false
SSDEEP:	12:758+vYfYeb8rcHEZrELFUt825rCX/+25rC3V5JfYeb8rcHEZrEZSJ:XYfYeb8nZrExg8KJfYeb8nZrEZe
MD5:	791F583001AFB8CD790F2DF8C0484EE4
SHA1:	8204E7CFBE28708022715744DBB14C6716B22DC8
SHA-256:	174FD8949F7F6D4FAC00A2A4085EB109620E9E273F6879ADE1B826F9ACAFE3BD
SHA-512:	00FC68F875598C04C388D52DF5AE40DF3C019D387BC748DFD3D1779E1D8C0A0C7A035346C9EEB241DB2E41A34E53FBCE10F7A9F983100E4D952B503E79FDFFD5
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:46.072 204c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/04-00:32:46.074 204c Recovering log #3.2024/12/04-00:32:46.074 204c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.108628524977069
Encrypted:	false
SSDEEP:	6:j/Au+L+q2Pwkn23oH+Tcwt8a2jMGIFUt8m/EoKWZmw+m/PLVkwOwkn23oH+Tcwtw:7sL+vYfYeb8EFUt82IW/+2PLV5JfYebw
MD5:	9FB059DB9D73F2E6E2E5635C22043CE0
SHA1:	6D013F49943D15E7ADA083BE1A75D3040CD46F54
SHA-256:	2BADE10ACCEB51BDFD5F33560FC5D653BAE84BA218D46D93EACC4128BC4266E5
SHA-512:	40BD41754D7F42F93FDD55DB22F1F7A8ECB7425FA57AB0C69640A4CFECA824269AE07BBEA7BC1BADB3463749D84CB0D80D016953ED2C4E3DBC7ACFB5FA54E085
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.512 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/04-00:32:44.513 1e3c Recovering log #3.2024/12/04-00:32:44.517 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.108628524977069
Encrypted:	false
SSDEEP:	6:j/Au+L+q2Pwkn23oH+Tcwt8a2jMGIFUt8m/EoKWZmw+m/PLVkwOwkn23oH+Tcwtw:7sL+vYfYeb8EFUt82IW/+2PLV5JfYebw
MD5:	9FB059DB9D73F2E6E2E5635C22043CE0
SHA1:	6D013F49943D15E7ADA083BE1A75D3040CD46F54
SHA-256:	2BADE10ACCEB51BDFD5F33560FC5D653BAE84BA218D46D93EACC4128BC4266E5
SHA-512:	40BD41754D7F42F93FDD55DB22F1F7A8ECB7425FA57AB0C69640A4CFECA824269AE07BBEA7BC1BADB3463749D84CB0D80D016953ED2C4E3DBC7ACFB5FA54E085
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.512 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/04-00:32:44.513 1e3c Recovering log #3.2024/12/04-00:32:44.517 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c081102-9c43-4e3b-98b4-14da3c110e7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3520513083942969
Encrypted:	false
SSDEEP:	48:TsKLopF+SawLUO1Xj8BNLd2Mc+nk7i3823XcmKvKWkqFX08:te+AuNHk238NmKdX08
MD5:	44C2D9940BB421B7D30EDEC43767F699
SHA1:	0E7E6AA4D3A01680BF3FD6F18A29E59BD0840AA0
SHA-256:	B9ED668E83096EF94FDFA8EEB063F76A2BAF9F2FA3C708214A844A8366B7ECB3
SHA-512:	6D8E27151C03E8C9746078D6F680751CAB01F2C66B7ED399E1C15C05011FD791A08E3B153F26F6B8D94FC29AE261EA22C73A6E827E53793FD6649357A7052BBC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	modified
Size (bytes):	36864
Entropy (8bit):	1.04371900235719
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBuW3:eIEumQv8m1ccnvS6JfWgN
MD5:	D18E8A97C0E6AB9957AE1390F2CDF3BF
SHA1:	2638253E3DDA2AAE2D5C96525E17F9D771584C4D
SHA-256:	D869E89F01BA514E73CB02E647FE60A307848B10C1EF734FC8607E38E490A7EE
SHA-512:	8239FE68DF6D3250F996E23758ECC6F9DE618CEF1B772944F1ACB3E905BCE6F95F68EA8FCFA6C3676AAAA6092D068025EE293B413F894A73291147A0612F35AB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF33b54.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Reputation:	unknown
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f7bc8db2-c117-42b3-8e25-25e195f5ae9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	175
Entropy (8bit):	2.874788585530478
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljl:S85aEFljljljljljljl
MD5:	6153AE3A389CFBA4B2FE34025943EC59
SHA1:	C5762DBAE34261A19EC867FFEA81551757373785
SHA-256:	93C2B2B9CE1D2A2F28FAC5AADC19C713B567DF08EAEEF4167B6543A1CD094A61
SHA-512:	F2367664799162966368C4A480DF6EB4205522EAAE32D861217BA8ED7CFABACBFBB0F7C66433FF6D31EC9638DA66E727E04C2239D7C6A0D5FD3356230E09AB6C
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.108481418794002
Encrypted:	false
SSDEEP:	6:j/yjL+q2Pwkn23oH+TcwtrQMxIFUt8m/fKWZmw+m/mLVkwOwkn23oH+TcwtrQMFd:7yjL+vYfYebCFUt82iW/+2mLV5JfYebf
MD5:	2002C68B1A250B8F1D5A8362D32B6EC0
SHA1:	C134A43D0B43AC8553E740C2DAA34862B6CC5AF9
SHA-256:	2711B5EDA15C8654C387E65303ED33846B25BAFC099C686505CBC03B5FC5BBED
SHA-512:	3AC619D47343F6D9008649172E2CB1CC972A6421F257624E8DA2A16D3D9FE8D601E9BA80F539FB67C19A496271B126CD25E92DE36710F19F3331DAA8A8C7E30A
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.972 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/04-00:32:44.973 1e3c Recovering log #3.2024/12/04-00:32:44.976 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.108481418794002
Encrypted:	false
SSDEEP:	6:j/yjL+q2Pwkn23oH+TcwtrQMxIFUt8m/fKWZmw+m/mLVkwOwkn23oH+TcwtrQMFd:7yjL+vYfYebCFUt82iW/+2mLV5JfYebf
MD5:	2002C68B1A250B8F1D5A8362D32B6EC0
SHA1:	C134A43D0B43AC8553E740C2DAA34862B6CC5AF9
SHA-256:	2711B5EDA15C8654C387E65303ED33846B25BAFC099C686505CBC03B5FC5BBED
SHA-512:	3AC619D47343F6D9008649172E2CB1CC972A6421F257624E8DA2A16D3D9FE8D601E9BA80F539FB67C19A496271B126CD25E92DE36710F19F3331DAA8A8C7E30A
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.972 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/04-00:32:44.973 1e3c Recovering log #3.2024/12/04-00:32:44.976 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377763966683161

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.7720359642572356
Encrypted:	false
SSDEEP:	3:3BytlX/GlkDMllttlyMOXpOXbB8NOUl68QllVc5B0pl1K/lB88/ZDwr9VA:3oakDM/9fOXpOXbK/x52ZuB8cypVA
MD5:	4FED097ECE9DACD240B9AD81E41E8D99
SHA1:	23E7F22719EC3BBFEED960F9A505A454FA18BE70
SHA-256:	3BF06D1BF87F6F69F08331F4CD511E2C1299F2D766A5A9ABDC4F1A071420C359
SHA-512:	B04519B943C8F25183D194768FAC7E0C68726ACCFE1061AC23D989D4EC680E0254CF2507E17F2CC16EBF9D0C5FF3CC9CDB164F224948E3923EACC5BBD2F8322C
Malicious:	false
Reputation:	unknown
Preview:	SNSS.......Xi.k...........Xi.k......"Xi.k...........Xi.k.......Xi.k.......Yi.k.......Yi.k....!..Yi.k...............................Xi.kYi.k1..,...Yi.k$...a19500e6_ecd7_476c_bc04_6d01517de4d3...Xi.k.......Yi.k......p........Xi.k...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0635170647669545
Encrypted:	false
SSDEEP:	6:j/eq2Pwkn23oH+Tcwt7Uh2ghZIFUt8m/IpZZmw+m/tzkwOwkn23oH+Tcwt7Uh2gd:7evYfYebIhHh2FUt82Iz/+2t5JfYebIT
MD5:	D07E14F5042F1B4CB12E66E6E75DF319
SHA1:	871898C5D94034B78D31115625F05A4CEFEEE080
SHA-256:	EC1CAF670FB401401959B3268A86FB218997C183158EF5464E85CA703C958B94
SHA-512:	28B834D8AE3C69B89D4485B0DD8F95C086118C9C304BA2E7F4922002917C3BC481EC786CB67AB9A5A82923D7E08A21CACB1D03690A6F68B49C07B6EB633F53A6
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.272 1c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/04-00:32:44.273 1c40 Recovering log #3.2024/12/04-00:32:44.311 1c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0635170647669545
Encrypted:	false
SSDEEP:	6:j/eq2Pwkn23oH+Tcwt7Uh2ghZIFUt8m/IpZZmw+m/tzkwOwkn23oH+Tcwt7Uh2gd:7evYfYebIhHh2FUt82Iz/+2t5JfYebIT
MD5:	D07E14F5042F1B4CB12E66E6E75DF319
SHA1:	871898C5D94034B78D31115625F05A4CEFEEE080
SHA-256:	EC1CAF670FB401401959B3268A86FB218997C183158EF5464E85CA703C958B94
SHA-512:	28B834D8AE3C69B89D4485B0DD8F95C086118C9C304BA2E7F4922002917C3BC481EC786CB67AB9A5A82923D7E08A21CACB1D03690A6F68B49C07B6EB633F53A6
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.272 1c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/04-00:32:44.273 1c40 Recovering log #3.2024/12/04-00:32:44.311 1c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNldbl:Ls3Jl
MD5:	7DB310B934AAE13E61129C3873F94A9F
SHA1:	4E3B6A3BBF90C6876C8F8FDEFE152A0DD3149211
SHA-256:	117E9C2491A73A9E747CF1A33DD4DFE944EF040F278737FBF11521B7870983AC
SHA-512:	6EFD09776A71B5A42FAFEDFC7BCE10E5284FCD9F6154F55583620F376125917091775A71497A063E2D6BB445769E0965F81D9F5FAA4F530F83CCB4131CD2B672
Malicious:	false
Reputation:	unknown
Preview:	........................................c?.e../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.210870323060556
Encrypted:	false
SSDEEP:	12:7UyvYfYebvqBQFUt82F/+2YGpR5JfYebvqBvJ:JYfYebvZg8AJfYebvk
MD5:	00A99532863977E122099A7176095207
SHA1:	EAF5271A11BDA61A0417AFD3359C33854A6B63A8
SHA-256:	12B747E51A6B14874FA148E01E46A4A61546FB75A40D4A3A9741E9A0760919F4
SHA-512:	C089D5224C8830065CA9A9C07F3D66C3F349522FBC9AA1063B4DD6AA258E136D327FBDAB3281E1D92E08D26AF84EBC52CC79230220377B2D056A9748BF8C8DA2
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.982 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/04-00:32:44.992 1cc4 Recovering log #3.2024/12/04-00:32:44.996 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.210870323060556
Encrypted:	false
SSDEEP:	12:7UyvYfYebvqBQFUt82F/+2YGpR5JfYebvqBvJ:JYfYebvZg8AJfYebvk
MD5:	00A99532863977E122099A7176095207
SHA1:	EAF5271A11BDA61A0417AFD3359C33854A6B63A8
SHA-256:	12B747E51A6B14874FA148E01E46A4A61546FB75A40D4A3A9741E9A0760919F4
SHA-512:	C089D5224C8830065CA9A9C07F3D66C3F349522FBC9AA1063B4DD6AA258E136D327FBDAB3281E1D92E08D26AF84EBC52CC79230220377B2D056A9748BF8C8DA2
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.982 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/04-00:32:44.992 1cc4 Recovering log #3.2024/12/04-00:32:44.996 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b098cbf2-ad41-4696-a3f8-341a0c47bccd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1328894852032505
Encrypted:	false
SSDEEP:	6:j/0Uq2Pwkn23oH+TcwtpIFUt8m/VZmw+m/aZnFkwOwkn23oH+Tcwta/WLJ:7PvYfYebmFUt82V/+2aZnF5JfYebaUJ
MD5:	4BF8A99F3D87C6540F4EBCF6909B58B3
SHA1:	4C738DC55D78F9C49D588C3A14FF430E3D77080C
SHA-256:	5B0C38505943F5027E39E32CAFFD8D6E009962463FEC680A98DDB9015DDCD3CF
SHA-512:	01113E397A6BDE0F02555A57B7F65C8003EC6282DF32C65146EF73B1B61AA3B86E468C0CB72A945F43C0D27F10BAC9DF34A5D31A3F966A3D0954A470DAF894E5
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.350 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/04-00:32:44.351 1ed4 Recovering log #3.2024/12/04-00:32:44.352 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1328894852032505
Encrypted:	false
SSDEEP:	6:j/0Uq2Pwkn23oH+TcwtpIFUt8m/VZmw+m/aZnFkwOwkn23oH+Tcwta/WLJ:7PvYfYebmFUt82V/+2aZnF5JfYebaUJ
MD5:	4BF8A99F3D87C6540F4EBCF6909B58B3
SHA1:	4C738DC55D78F9C49D588C3A14FF430E3D77080C
SHA-256:	5B0C38505943F5027E39E32CAFFD8D6E009962463FEC680A98DDB9015DDCD3CF
SHA-512:	01113E397A6BDE0F02555A57B7F65C8003EC6282DF32C65146EF73B1B61AA3B86E468C0CB72A945F43C0D27F10BAC9DF34A5D31A3F966A3D0954A470DAF894E5
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.350 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/04-00:32:44.351 1ed4 Recovering log #3.2024/12/04-00:32:44.352 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9312584730793054
Encrypted:	false
SSDEEP:	192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
MD5:	4ECC14F9549C4BB53159212C5BCC9CC0
SHA1:	EFEABE631F20B60E2863952BFF0F485BEB74CE36
SHA-256:	49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
SHA-512:	6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:Lkjl1lhtl9kM:o3r
MD5:	9DD402DCB1C8B54A118236DA111FD4F2
SHA1:	D8AB1B30528835AC112BD9B0AC0044471EF558DF
SHA-256:	A84930F9CF9DB83EC31D9E5A8D2E7CB465DD2E977513B2AD722ADAE3C18687B2
SHA-512:	601870032DD74F2C86D43EF7BEE1CA268411E73CA0BE26ADE71C4022098D3EE5F19CC17650E965FD4F08C3DF26F675D25577CCAD965E0B50A65401E402B72E6F
Malicious:	false
Reputation:	unknown
Preview:	............O%Ai...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aebc2d6d-79c2-4366-8f69-9a379c684297.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3852), with CRLF line terminators
Category:	dropped
Size (bytes):	11417
Entropy (8bit):	5.237554345326078
Encrypted:	false
SSDEEP:	192:dH4vrmORnBtW4PoiUDNaxvR5FCHFcoaSbqGEDu:dH4vrmonPW4jR3GaSbqGEDu
MD5:	DF790948C5A7B5DD19D033FE6C793868
SHA1:	0C4A681E07505CA84997CE78FEEE1F0D88CB8E2A
SHA-256:	CB4049061A6A78013D20CC4AB396BEF4F6C35306887BE76765EED4E51EEE702D
SHA-512:	251C3B5DE5452E2F40C648BDB2E3D1CE2315DD4DFFAF4B4E5E08528DBAAB80535F1A82E183A65AB7DCA0C2926AE5D6B61F06DB390D0E3B8D8E77E826B21042CB
Malicious:	false
Reputation:	unknown
Preview:	{.. "ArbitrationSignal": "(time_elapsed_since_last_notification)-3600^(notification_quick_dismiss_rate_lower_ci+notification_disable_rate+notification_snooze_rate)",.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f41

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.167935620342828
Encrypted:	false
SSDEEP:	6:j/kWH0RM1wkn23oH+Tcwtfrl2KLlJ/9pMq2Pwkn23oH+TcwtfrK+IFUv:7/0RrfYeb1LjXMvYfYeb23FUv
MD5:	3ABDC5900C3F124AD724DBD06F29C37E
SHA1:	12C78A46C74F8C7C378A643F7B28782249834BA6
SHA-256:	86D6FE0825CC540AAC84251903F200F69FA10C436ED0024151317DCB24FD8836
SHA-512:	51934A2F418C1B375C51FD14C6A6E256D398AAE0E7E38A717A9C57D0C0E97BAC2AFD89BE99B9DBE31BA8715B28D3902B1144295E7A8CC166DA625B0CDE30DA0A
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:45.130 1e24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/12/04-00:32:45.406 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.6995049215784723
Encrypted:	false
SSDEEP:	3:G0XttkJcsRwI9tkJcscml9t3moiOlfmEaHTltfmoI///fmEbn:G0Xtqcsqc9Ct3mxKm9HTl1mL//3m8
MD5:	D0D92D2ACC26306AEC6E8D67FD89BB1D
SHA1:	98C9F038C1C81881F5EB5E103530458845BCEEA9
SHA-256:	3B6E086A61E5DA0B64E80F593E648BD49FE77CE072098065399BE2B4F4F46840
SHA-512:	5464728663F1F62E9DBD7DF26D92FE7CC41B6BFDEE9021CEE5ED230B9F3114ACFF54768E5206B283382CBFF6999B07DF9283ED3DA50E04631729D22DD8E4CB5D
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.160113554309857
Encrypted:	false
SSDEEP:	6:j/rcuzRM1wkn23oH+Tcwtfrzs52KLlJ/kCFpMq2Pwkn23oH+TcwtfrzAdIFUv:7IuzRrfYebs9Lj5MvYfYeb9FUv
MD5:	D23DEE4D1C029A7CAB83C813D0895234
SHA1:	43D33F01D58B1A0B129BB23F01FEED46B0F861AA
SHA-256:	3DDA50E4F1B230891982D417BEA9E34F938D337B15C4BA83C4ED3198F769BD9A
SHA-512:	1EC3D3EB8EF7E224DCCF57BDCC13049768668BDBDD2622A06E7743B9CEB5ADF518341EEBFFA200DDF9BED6FC7C1F3A1CE52905864A963B49F40A0A297D414DE1
Malicious:	false
Reputation:	unknown
Preview:	2024/12/04-00:32:44.769 1e24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/12/04-00:32:45.127 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl8AkLl/l:Ls3cl
MD5:	D75EAAAE29086B0AB4ED201E05C34C1B
SHA1:	0C5E49AFE8DA5C69DC4F532DCAEEB6949A71C313
SHA-256:	FBBE8511DE084D832FD0CB2E283DE9E7FE2A0374BBA2928EEE983956678B3B60
SHA-512:	91620B9BDF53B8C86282D0EAD7B8DF90DC9909D68C26F7C054AC3CF7817CBD4DF53F15B299B372279AF998D592EC0C52932042864C33F4EF5B6648ADBFCA3885
Malicious:	false
Reputation:	unknown
Preview:	...........................................e../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl8sAeltl:Ls38sAeltl
MD5:	B3274AC5DF5C1863161F550974F4C441
SHA1:	CD53524BD60C8D0CC8F3CD863F8CA84A6320A8B3
SHA-256:	F764D434EECDD5E33A6960DB031A78B05C762BEC7F69BD926619A493C6BCB2F2
SHA-512:	18877166905ECD00C280A17B3EF53D32AA79DD3B84F68B0DD3E24AEC2C28D9045D715FBE817D7A0074AF020DB3B05DFF08320A92B8DDE427ED76EA7F791F7F88
Malicious:	false
Reputation:	unknown
Preview:	...........................................e../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794003621625986
Encrypted:	false
SSDEEP:	192:akm0sbLeiRUJh16qRAq1k8SPxVLZ7VTiq:akZs7c16q3QxVNZTiq
MD5:	279D717037CE121916CB6ED78613BA9F
SHA1:	21E84B21D7BED02559A57315C92957FBAF3DE9CE
SHA-256:	2534CA244AE77F5ECA9AB4B0FF4C47DFB1CFE4FC3DBBE18E070EE591BCF49175
SHA-512:	D3BC6A1B25171C8459B6C70594E86509D4E29CC323117784B1A4C94698F868CDA4DD3AB846CF361D3877ABA5EF1496D698E6DFD4D3C5051D486573830F6B5C9F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADcH/FMRTSN/GAQnHWOJ2rMPf+/om00Ja0Hrz+xwyA4qgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32d5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794003621625986
Encrypted:	false
SSDEEP:	192:akm0sbLeiRUJh16qRAq1k8SPxVLZ7VTiq:akZs7c16q3QxVNZTiq
MD5:	279D717037CE121916CB6ED78613BA9F
SHA1:	21E84B21D7BED02559A57315C92957FBAF3DE9CE
SHA-256:	2534CA244AE77F5ECA9AB4B0FF4C47DFB1CFE4FC3DBBE18E070EE591BCF49175
SHA-512:	D3BC6A1B25171C8459B6C70594E86509D4E29CC323117784B1A4C94698F868CDA4DD3AB846CF361D3877ABA5EF1496D698E6DFD4D3C5051D486573830F6B5C9F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADcH/FMRTSN/GAQnHWOJ2rMPf+/om00Ja0Hrz+xwyA4qgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32d7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794003621625986
Encrypted:	false
SSDEEP:	192:akm0sbLeiRUJh16qRAq1k8SPxVLZ7VTiq:akZs7c16q3QxVNZTiq
MD5:	279D717037CE121916CB6ED78613BA9F
SHA1:	21E84B21D7BED02559A57315C92957FBAF3DE9CE
SHA-256:	2534CA244AE77F5ECA9AB4B0FF4C47DFB1CFE4FC3DBBE18E070EE591BCF49175
SHA-512:	D3BC6A1B25171C8459B6C70594E86509D4E29CC323117784B1A4C94698F868CDA4DD3AB846CF361D3877ABA5EF1496D698E6DFD4D3C5051D486573830F6B5C9F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADcH/FMRTSN/GAQnHWOJ2rMPf+/om00Ja0Hrz+xwyA4qgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.371990371861502E-4
Encrypted:	false
SSDEEP:	3:LsNlurKXl:Ls32ql
MD5:	62CA331FE957CEE1416BD6501489C185
SHA1:	47473292D1B859181E67AB8D287931E519B53DC6
SHA-256:	7680DCC7556B1D9B86031D2AD77353D31E01339C8D9C4B8D0D4740BB937F3E7A
SHA-512:	4DCA3D639EB0926061BF92AC0A21BD499F19F2ADBB9F74F33C547329CA8DADE91584963A18FF4EBB53757D8ABD9EEE42798D12500304086D8A731AAC328CA2DA
Malicious:	false
Reputation:	unknown
Preview:	........................................vW.e../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Reputation:	unknown
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Reputation:	unknown
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Reputation:	unknown
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Reputation:	unknown
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.415446034314543
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQd:YQ3Kq9X0dMgAEwjj
MD5:	3FA87FFDBFD627F217A5F052D6D3A7AC
SHA1:	0746F46DE416E30212C78E240BF6B5352EE2EF9C
SHA-256:	7C782809649AE44D26AD9EC63F900A8B306E91ED01410EEDD6A9AB778770ED2B
SHA-512:	EDAEDD2E75B29829BE86D25CB0D894832FCA323FD12493133E9230007D3FA353F12F3DBC87DAD9FE2B86D0F26EC3814C9951975ADFF3421623C44642AA780894
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":14}

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2278
Entropy (8bit):	3.846605072156215
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxoyxl9Il8ujMFiaBg9ez2A9IAawDd1rc:mUYoBg9ez2Yawk
MD5:	03DDB170DF7654FA93E4C6817EF73CDE
SHA1:	C16D8486D1A5AB65DCFB658FBF0F4ED9EA24A12D
SHA-256:	BFB4CE7243E479B220575D465C67D2471053FE62C5F11187D549F7A99BB153DD
SHA-512:	CED1D5456DAE2AB704B4F2473F999004CC842C02C809D5BE4EABA36E200305CE158CCFAB4BF39ACC078966DD6BFFC649AF4609748C7EB9AE1CCA87C51200B3DE
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.u.X.V.B.Z.G.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.n.L.q.I.0.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9994548658794553
Encrypted:	false
SSDEEP:	96:yaYlJzGkd9cugkJSWcnCSs2t4C4KW06T4gJ2Ev:yau9cccU2tbXsHv
MD5:	22584D2A4FB9F1112BC0D10521D1C75D
SHA1:	30E178E58928B8A017901FC77F4A8F161CF4C32D
SHA-256:	477247AF16C2335AA33C4E1FF556B51DD1CB9135143FA037A6A7E1144AEBF30B
SHA-512:	B2C1958EA874F2A4ED8798DA2DEE889D2E0AFF8AF34CBE6276AA5580BF40746EFFDCE9134A02C09E678DADEA5EF414540C18C6ABB95A47E937CBA7CDA6A6A835
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.c.v.5.O.g.5.G.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.n.L.q.I.0.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9054598183642115
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xZgxl9Il8ujXem/JgUZ5oVJslDEv+Xid/vc:aoYgO9oV2/
MD5:	111C16244D76A4163077E1C544E2CEC1
SHA1:	86E5FB06DBE64719B6C444E053951055A9760366
SHA-256:	F9F9B92EBDDBBF8ADE45D8A9027BC4F512194065838674C19B7AB72DD15C97A0
SHA-512:	CE70E3EC0EFF947915A3A6B663D6A74280BCC3725CC93059FCA1C1569E6AA12CA13B74FAD30A3DD531502175B96DD62655AC43200B16F2F7F886686534A260DC
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".7.J.P.8.a.9.9.k.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.n.L.q.I.0.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162028032
Entropy (8bit):	6.733467447219974
Encrypted:	false
SSDEEP:	1572864:2CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:MDAgZi
MD5:	7153F5DCF75B41969A641F98F370D035
SHA1:	E1D0C1D865C126BDED0376E01DCB18FC1D2F622D
SHA-256:	FB7506B750512AA4807F75CB0F9401C0A34A1097E35D5EC78B468557261C50F1
SHA-512:	2CBA838A3EDEBBE964BE243966976DB3C5A9AD1041ADDC467543699C182320991FA66C3A54A4C05D16818CCE395B38D3016D72E84E476F988535BF0DE811CC53
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..\|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

C:\Users\user\AppData\Local\Programs\unrealgame\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	129690
Entropy (8bit):	7.91868310789661
Encrypted:	false
SSDEEP:	3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
MD5:	8626E1D68E87F86C5B4DABDF66591913
SHA1:	4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
SHA-256:	2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
SHA-512:	03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
Malicious:	false
Reputation:	unknown
Preview:	..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l....m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.\|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....\|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

C:\Users\user\AppData\Local\Programs\unrealgame\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	179971
Entropy (8bit):	7.941375268079628
Encrypted:	false
SSDEEP:	3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
MD5:	48515D600258D60019C6B9C6421F79F6
SHA1:	0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
SHA-256:	07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
SHA-512:	B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
Malicious:	false
Reputation:	unknown
Preview:	..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y....y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...)..........+....0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g\|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~.............+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....\|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y....z.....{....\|.<...}.....~.............1...........L..........z.................G...........X...........f...............@.....................q...........Y..........W...........;........................

C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4891080
Entropy (8bit):	6.392150637672776
Encrypted:	false
SSDEEP:	49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
MD5:	CB9807F6CF55AD799E920B7E0F97DF99
SHA1:	BB76012DED5ACD103ADAD49436612D073D159B29
SHA-256:	5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
SHA-512:	F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2862080
Entropy (8bit):	6.7042588011125215
Encrypted:	false
SSDEEP:	49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
MD5:	D49E7A8F096AD4722BD0F6963E0EFC08
SHA1:	6835F12391023C0C7E3C8CC37B0496E3A93A5985
SHA-256:	F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
SHA-512:	CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X......."...n.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\unrealgame\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10541296
Entropy (8bit):	6.277012685259397
Encrypted:	false
SSDEEP:	98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
MD5:	ADFD2A259608207F256AEADB48635645
SHA1:	300BB0AE3D6B6514FB144788643D260B602AC6A4
SHA-256:	7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
SHA-512:	8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\4a9c2010-35c8-4393-942c-15e481873128.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	696832
Entropy (8bit):	5.71955944202422
Encrypted:	false
SSDEEP:	12288:I7P4JLntTmvCGWJ19UOkhOXjpb277I74liAANjDaZrnOB:vJLyAq2
MD5:	A3A6DC7F9B3C8E0DAA2F210E39BEA213
SHA1:	EE26C3C76A73D1A0526767C6DDD58E08F0F65198
SHA-256:	678B8AB500C3968A1B7CDCDB1F242E380670A49C659F305D50DAC0262974BE11
SHA-512:	9ED3319DA2AEC88CC2FF591FC58BC8FCD75921551BC366FC9F20D2AE106E77D8EF32A5E32470B53434313F305CE30D9B1712BFC014919F898D726E9D7E27EAD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yR.R.R....+W....+.....+X....+\....+[....+{....+W.R......+P....+S...IS....+S.RichR.................PE..d...r..e.........." .....n...P...............................................0............`.........................................`...s...h...<.......<....P...L...................f..8........................... e..8...............h.......@....................text....l.......n.................. ..`.rdata..............r..............@..@.data...!5..........................@....pdata..PU...P...V..................@..@.idata...............d..............@..@.didat...............x..............@....00cfg..Q...........................@..@_RDATA.."...........................@..@.rsrc...<...........................@..@.reloc..M...........................@..B........................................................................

C:\Users\user\AppData\Local\Temp\7aaf3dde-09fa-49d0-88e8-53e6e9603ea9.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	255488
Entropy (8bit):	6.3283471797462285
Encrypted:	false
SSDEEP:	6144:3o06awTFRroAJKQEozTk/us7bqm/ohOnI:3o0cTjVJKQ9k/7bqm/o
MD5:	DE00E0648BB3EE003375504188D473EF
SHA1:	A43BE3FA52B56A4E8610590AC9465AA25401FBE5
SHA-256:	9666F8E196C798EF4419B1E6C1A8D4BDB4A399CCAB485A32A38BEF6EAEB4A384
SHA-512:	11772462CDAEFCFAAEF1D6D19C55C6454D8402E0056552FCBF63F68B5C999939A8BE34769B5FCB74872E2D7A890C0075B35D7E23565F76D246D5D624403A15B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g.............9.......9...G...9...........................9..............d.......d.......d.......d.......Rich............PE..d......a.........." .....x..........8t.......................................P............`......................................... ...\...\|...<....0..........d ...........@..l...@y..p...........................Pq..8...................d...@....................text...tv.......x.................. ..`.rdata...(.......*...\|..............@..@.data....&..........................@....pdata..d ......."..................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc..l....@......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Chromium_Cookies.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	310
Entropy (8bit):	3.9873117740411184
Encrypted:	false
SSDEEP:	6:5jc52cOi/Rj69Dq3Oi/tPMy2cO3Dq3+q3ORZ:5jcrJjMDklPMdDz/Z
MD5:	5863761BE8E207B078C0F25A2ABC7015
SHA1:	29F0EC338AD95500E62AFA8A859126C404F01BE1
SHA-256:	3E89353F29EF90DC4C4036697A5081D62802A1A1B1F73A3833A2F1324C928715
SHA-512:	7BD97C647D39E46F7DBC5E380F90FEE736F195A1BBFA2D100589BC0C5B9F715EA90B1FDE59D341BBD538E8B47197DF846A595F116269023FFC10252FEDF0E377
Malicious:	false
Reputation:	unknown
Preview:	PK.........,.Y................chrome_default_Cookies.txt..PK..............PK.........,.Y................edge_default_Cookies.txt..PK..............PK..-........,.Y...................... .......chrome_default_Cookies.txtPK..-........,.Y...................... ...J...edge_default_Cookies.txtPK....................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kdkotn2.0pq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1o0lcihe.b0d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lu4d4wg.bss.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bv4ejd0z.33z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csov4lpj.gk4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_elmstevw.cd0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmunljfb.2sa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v5qsyqud.tdk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\all-files.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	Zip archive data (empty)
Category:	modified
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Reputation:	unknown
Preview:	PK....................

C:\Users\user\AppData\Local\Temp\b392957b-4ff5-4378-8506-05f7ec588e9f.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.055411992765344
Encrypted:	false
SSDEEP:	3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
MD5:	04BFBFEC8DB966420FE4C7B85EBB506A
SHA1:	939BB742A354A92E1DCD3661A62D69E48030A335
SHA-256:	DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
SHA-512:	4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d343d789-d963-4936-b357-2cb8e482c52e.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1453056
Entropy (8bit):	6.517222544789646
Encrypted:	false
SSDEEP:	24576:HczztZ12vAxqcdzoAyv+liT0eYiYJ869tUb/K:8zztZ12vodwW0T0NZJftm
MD5:	56192831A7F808874207BA593F464415
SHA1:	E0C18C72A62692D856DA1F8988B0BC9C8088D2AA
SHA-256:	6AA8763714AA5199A4065259AF792292C2A7D6A2C381AA27007255421E5C9D8C
SHA-512:	C82AA1EF569C232B4B4F98A3789F2390E5F7BF5CC7E73D199FE23A3F636817EDFDC2FB49CE7F69169C028A9DD5AB9F63E8F64964BB22424FC08DB71E85054A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z2..;\Q.;\Q.;\Q.]XP.;\Q.]_P.;\Q.]YPw;\Q.SXP.;\Q.S_P.;\Q.SYP.;\Q.]]P.;\Q.;]Q6;\QcRUP.;\QcR\P.;\QcR.Q.;\QcR^P.;\QRich.;\Q........PE..d....}*`.........." ................T.....................................................`.............................................\.......(....P.......p...............`......P...p............................7..........................@....................text............................... ..`.rdata..&J.......L..................@..@.data...dR.......<..................@....pdata.......p.......:..............@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\KametaSetup.exe

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162028032
Entropy (8bit):	6.733467447219974
Encrypted:	false
SSDEEP:	1572864:2CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:MDAgZi
MD5:	7153F5DCF75B41969A641F98F370D035
SHA1:	E1D0C1D865C126BDED0376E01DCB18FC1D2F622D
SHA-256:	FB7506B750512AA4807F75CB0F9401C0A34A1097E35D5EC78B468557261C50F1
SHA-512:	2CBA838A3EDEBBE964BE243966976DB3C5A9AD1041ADDC467543699C182320991FA66C3A54A4C05D16818CCE395B38D3016D72E84E476F988535BF0DE811CC53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..\|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6766160
Entropy (8bit):	4.735324161006094
Encrypted:	false
SSDEEP:	24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
MD5:	180F8ACC70405077BADC751453D13625
SHA1:	35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
SHA-256:	0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
SHA-512:	40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
Malicious:	false
Reputation:	unknown
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	129690
Entropy (8bit):	7.91868310789661
Encrypted:	false
SSDEEP:	3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
MD5:	8626E1D68E87F86C5B4DABDF66591913
SHA1:	4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
SHA-256:	2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
SHA-512:	03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
Malicious:	false
Reputation:	unknown
Preview:	..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l....m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.\|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....\|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	179971
Entropy (8bit):	7.941375268079628
Encrypted:	false
SSDEEP:	3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
MD5:	48515D600258D60019C6B9C6421F79F6
SHA1:	0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
SHA-256:	07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
SHA-512:	B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
Malicious:	false
Reputation:	unknown
Preview:	..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y....y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...)..........+....0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g\|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~.............+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....\|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y....z.....{....\|.<...}.....~.............1...........L..........z.................G...........X...........f...............@.....................q...........Y..........W...........;........................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4891080
Entropy (8bit):	6.392150637672776
Encrypted:	false
SSDEEP:	49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
MD5:	CB9807F6CF55AD799E920B7E0F97DF99
SHA1:	BB76012DED5ACD103ADAD49436612D073D159B29
SHA-256:	5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
SHA-512:	F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2862080
Entropy (8bit):	6.7042588011125215
Encrypted:	false
SSDEEP:	49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
MD5:	D49E7A8F096AD4722BD0F6963E0EFC08
SHA1:	6835F12391023C0C7E3C8CC37B0496E3A93A5985
SHA-256:	F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
SHA-512:	CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X......."...n.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10541296
Entropy (8bit):	6.277012685259397
Encrypted:	false
SSDEEP:	98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
MD5:	ADFD2A259608207F256AEADB48635645
SHA1:	300BB0AE3D6B6514FB144788643D260B602AC6A4
SHA-256:	7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
SHA-512:	8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@'..H..`.(..H...e).7H..0.).VH...).xH......H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.320849747462847
Encrypted:	false
SSDEEP:	12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
MD5:	09134E6B407083BAAEDF9A8C0BCE68F2
SHA1:	8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
SHA-256:	D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
SHA-512:	6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7514112
Entropy (8bit):	6.462467169487978
Encrypted:	false
SSDEEP:	98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
MD5:	A5F1921E6DCDE9EAF42E2CCC82B3D353
SHA1:	1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
SHA-256:	50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
SHA-512:	0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..\|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	362355
Entropy (8bit):	5.4138809970208035
Encrypted:	false
SSDEEP:	6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
MD5:	464E5EEABA5EFF8BC93995BA2CB2D73F
SHA1:	3B216E0C5246C874AD0AD7D3E1636384DAD2255D
SHA-256:	0AD547BB1DC57907ADEB02E1BE3017CCE78F6E60B8B39395FE0E8B62285797A1
SHA-512:	726D6C41A9DBF1F5F2EFF5B503AB68D879B088B801832C13FBA7EB853302B16118CACDA4748A4144AF0F396074449245A42B2FE240429B1AFCB7197FA0CB6D41
Malicious:	false
Reputation:	unknown
Preview:	..........].h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....\|.....}................................................................... .....M.....Z.....i.....z...........................................................!.....4.....T.....[.....k.....{...........................................................$.....4.....B.....x.............................................................................2.....K.....g.....u.....}........................................................... .....0.....L.....a.......................................................................9.....N.....g.....n.....q.....r.....~.........................................D.....L.......................................................................'.....<.....^.....q................................................... .....".....%.D...(.`...*.....+.....,.........../.....0.....1.....3.....4.+...5.F...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.8...C.`...D.g.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	583572
Entropy (8bit):	4.947180410657857
Encrypted:	false
SSDEEP:	12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
MD5:	2C933F084D960F8094E24BEE73FA826C
SHA1:	91DFDDC2CFF764275872149D454A8397A1A20AB1
SHA-256:	FA1E44215BD5ACC7342C431A3B1FDDB6E8B6B02220B4599167F7D77A29F54450
SHA-512:	3C9ECFB0407DE2AA6585F4865AD54EEB2EC6519C9D346E2D33ED0E30BE6CC3EBFED676A08637D42C2CA8FA6CFEFB4091FEB0C922FF71F09A2B89CDD488789774
Malicious:	false
Reputation:	unknown
Preview:	..........Q.h.@...i.K...j.W...k.f...l.q...n.y...o.~...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................&.....-.....4.....5.....6.....;.....g........................................./.....7.....\|...............................................A.....a.....q............................./.....R.....d.....m.............................4.....@.....O.....e...............................................I.....{............................................... .....3.....h.....w.............................:.....R.............................).....H.....n.....q.......................'.....G.....p.....w.....z.....{.........................................l.................".....B....._.....................................................;.....c.................).....u....................................... .....".0...%.f...(.....*.....+.....,.........../.....0.1...1.....3.....4.....5.....6.{...7.....8.....9.....;.....<.....=.5...>.o...?.y...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	639744
Entropy (8bit):	4.950537001099058
Encrypted:	false
SSDEEP:	12288:K+sgtqIj5/XvYUtOkQIkqBJ5SNbW+eTtvZEMgSENjM:KD4Fek75z+K
MD5:	FDBAD4C84AC66EE78A5C8DD16D259C43
SHA1:	3CE3CD751BB947B19D004BD6916B67E8DB5017AC
SHA-256:	A62B848A002474A8EA37891E148CBAF4AF09BDBA7DAFEBDC0770C9A9651F7E3B
SHA-512:	376519C5C2E42D21ACEDB1EF47184691A2F286332451D5B8D6AAC45713861F07C852FB93BD9470FF5EE017D6004ABA097020580F1BA253A5295AC1851F281E13
Malicious:	false
Reputation:	unknown
Preview:	........~.z.h.....i.....j.....k.....l.....n.'...o.,...p.9...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}...................................................................).....B....._.........................................-....._.....b.....f.........................................0.....G...................................................../.....O...............................................-.....7.....g.............................5.....`...............................................K.....[.....r.............................a.........................................".....=.....\.....w.................................................................V.......................o.............................<.....Y.....i.....q.....}.......................<.....^.........................................<.....M... ._...".\|...%.....(.....*.M...+.P...,.n........./.....0.....1.....3.....4.=...5.d...6.....7.....8.....9.6...;.Q...<.r...=.....>.....?.....@.....A.....C.....D.....E.Y...F...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	667826
Entropy (8bit):	4.715111408941832
Encrypted:	false
SSDEEP:	12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
MD5:	38BCABB6A0072B3A5F8B86B693EB545D
SHA1:	D36C8549FE0F69D05FFDAFFA427D3DDF68DD6D89
SHA-256:	898621731AC3471A41F8B3A7BF52E7F776E8928652B37154BC7C1299F1FD92E1
SHA-512:	002ADBDC17B6013BECC4909DAF2FEBB74CE88733C78E968938B792A52C9C5A62834617F606E4CB3774AE2DAD9758D2B8678D7764BB6DCFE468881F1107DB13EF
Malicious:	false
Reputation:	unknown
Preview:	..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....4.........................................:.....F.....P.........................................Q.....]...................................,.....V.........................................7...................................9.....?.....M.....a.......................9.....i.........................................(.....N.....x.......................=.....X.....n.......................Z.....s...................................8.....h.......................+.....2.....5.....6.....J.....`.....\|.................(...........B.....N.................>...................................,.....6.....j.................7.....s.................?.....Q.....g..................... .....".....%.U...(.....*.....+.....,....... .../.N...0.W...1.....3.....4.....5.N...6.....7.....8.....9.@...;.m...<.....=.....>.....?.....@.....A.D...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	858553
Entropy (8bit):	4.32277927640417
Encrypted:	false
SSDEEP:	3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
MD5:	9340520696E7CB3C2495A78893E50ADD
SHA1:	EED5AEEF46131E4C70CD578177C527B656D08586
SHA-256:	1EA245646A4B4386606F03C8A3916A3607E2ADBBC88F000976BE36DB410A1E39
SHA-512:	62507685D5542CFCD394080917B3A92CA197112FEEA9C2DDC1DFC77382A174C7DDF758D85AF66CD322692215CB0402865B2A2B212694A36DA6B592028CAAFCDF
Malicious:	false
Reputation:	unknown
Preview:	..........].h.(...i.9...j.E...k.T...l._...n.g...o.m...p.z...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................!.....(.....)........../.......................9.....K.....g.............................R.....T.....X.......................&.....[.............................E.....x.......................-.....O.....}.................e.....t.........................................5.....q.................2.....r.........................................-.....I.......................x...............................................@.....r.............................5.....c...............................................6.....M.....n.................1.....I.......................f.........................................@.................i...............................................J.....h... .}...".....%.....(.P........,.........../.....0.....1.....3.....4.....5.^...6.....7.....8.u...9.....;.....<.....=.....>.R...?.e...@.....A.....C.c...D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	409695
Entropy (8bit):	5.417085582145732
Encrypted:	false
SSDEEP:	12288:bgoRVrijIs3cejEYBCqS4o3nbhjJSwHQliEwfwVEMXdLbpuQ16BtryBiGIle3nei:b3GQUwJAMNTCypxB5WMml
MD5:	4CD6B3A91669DDCFCC9EEF9B679AB65C
SHA1:	43C41CB00067DE68D24F72E0F5C77D3B50B71F83
SHA-256:	56EFFF228EE3E112357D6121B2256A2C3ACD718769C89413DE82C9D4305459C6
SHA-512:	699BE9962D8AAE241ABD1D1F35CD8468FFBD6157BCD6BDF2C599D902768351B247BAAD6145B9826D87271FD4A19744EB11BF7065DB7FEFB01D66D2F1F39015A9
Malicious:	false
Reputation:	unknown
Preview:	..........R.h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....3.....\.....v...............................................&.....D.....F.....J.....r.....................................................%.....5.....S.....n.....q.....{.........................................%.....5.....8.....;.....D.....X.....n.....................................................#.....5.....D.....U.....k.....r...................................'.....H.....Q.....b.....u.....................................................).....0.....3.....4.....=.....F.....N.....T.....f.................,.....4.....o.........................................$...../.....4.....J.....t.............................%.....>.....C.....M.....^.....z......... .....".....%.....(.....*.....+.....,.&.....P.../.m...0.r...1.....3.....4.....5.....6.1...7.B...8.V...9.h...;.v...<.....=.....>.....?.....@.....A.....C.....D.&...E.Z.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	419829
Entropy (8bit):	5.845882900283008
Encrypted:	false
SSDEEP:	6144:RquUIAMYOnQYeAIV4g558YwGKNDsku8Qy:Rq/IA5On504g558YwbNDsC
MD5:	EEEE212072EA6589660C9EB216855318
SHA1:	D50F9E6CA528725CED8AC186072174B99B48EA05
SHA-256:	DE92F14480770401E39E22DCF3DD36DE5AD3ED22E44584C31C37CD99E71C4A43
SHA-512:	EA068186A2E611FB98B9580F2C5BA6FD1F31B532E021EF9669E068150C27DEEE3D60FD9FF7567B9EB5D0F98926B24DEFABC9B64675B49E02A6F10E71BB714AC8
Malicious:	false
Reputation:	unknown
Preview:	..........s.h.....i.....j.....k.....l....n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.........................................................................+.....;.....M....._.....h.....u...............................................G.....].....{.....................................................1.....@.....F.....M.....^.....p.................................................................0.....E.....[.....t.................................................................+.....6.....H.........................................".....(.....4.....@.....P.....u.....x.........................................................................................].......................A.....^.....z...............................................!.....G.....b.............................,.....3.....=.....J.....g.....q... .y...".....%.....(..........+.....,.......(.../.?...0.I...1.....3.....4.....5.....6.....7. ...8.6...9.L...<.^...=.h...>.}...?.....@.....A.....C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	380107
Entropy (8bit):	5.46366244634788
Encrypted:	false
SSDEEP:	6144:czP4qlrn8+ua0swlGVJJwoXlw5CvET5VTrBGzO7iJyd4tTWwT:dqlr89JklwH55rETL
MD5:	E7BA94C827C2B04E925A76CB5BDD262C
SHA1:	ABBA6C7FCEC8B6C396A6374331993C8502C80F91
SHA-256:	D8DA7AB28992C8299484BC116641E19B448C20ADF6A8B187383E2DBA5CD29A0B
SHA-512:	1F44FCE789CF41FD62F4D387B7B8C9D80F1E391EDD2C8C901714DD0A6E3AF32266E9D3C915C15AD47C95ECE4C7D627AA7339F33EEA838D1AF9901E48EDB0187E
Malicious:	false
Reputation:	unknown
Preview:	..........H.h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....y...........................................................+.....-.....1.....Y.....n.................................................................-.....3.....;.....K.....o.......................................................................,.....C.....Y.....s.............................................................................?.....H.....i................................................................. .....+.....?.....Q.....e.....l.....o.....p.....w.........................................S.....W.................................................................".....?.....V...............................................".....5.....?... .C...".K...%.f...(.....*.....+.....,.........../.....0.....1.9...3.E...4._...5.w...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.(...A._...C.\|...D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	406584
Entropy (8bit):	5.519300999448185
Encrypted:	false
SSDEEP:	6144:V3JEmQ1hqVK+6aU8WUmzg3ELWzhqY305QgfXlIsCJd:V5t6sKXaK/LWy5POsCJd
MD5:	CF22EC11A33BE744A61F7DE1A1E4514F
SHA1:	73E84848C6D9F1A2ABE62020EB8C6797E4C49B36
SHA-256:	7CC213E2C9A2D2E2E463083DD030B86DA6BBA545D5CEE4C04DF8F80F9A01A641
SHA-512:	C10C8446E3041D7C0195DA184A53CFBD58288C06EAF8885546D2D188B59667C270D647FA7259F5CE140EC6400031A7FC060D0F2348AB627485E2207569154495
Malicious:	false
Reputation:	unknown
Preview:	........S...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}............................................................................./.....7.....@.....f.....\|.....~.....................................................%.....M.....a.....o...............................................8.....L.....S.....^.....v.....................................................6....._.......................................................................7.....H.....a.....r...............................................".....5.....K....._.....x.................................................................?.............................#.....M.....x...........................................................(.....F.....j............................................. .....".....%.1...(.N...*.q...+.t...,.........../.....0.....1.....3.....4.....5.7...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.>...C.]...D.g.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	729549
Entropy (8bit):	4.799528683257041
Encrypted:	false
SSDEEP:	12288:AQbueXYquNw2202pgtZBAujt4NIbsJvaP5A3HRsgQiEYQ3C1gf2ns4CfFnx1Xu2v:B2quNw2202pgtHAujmNrJvaRA3HRsDik
MD5:	E66A75680F21CE281995F37099045714
SHA1:	D553E80658EE1EEA5B0912DB1ECC4E27B0ED4790
SHA-256:	21D1D273124648A435674C7877A98110D997CF6992469C431FE502BBCC02641F
SHA-512:	D3757529DD85EF7989D9D4CECF3F7D87C9EB4BEDA965D8E2C87EE23B8BAAEC3FDFF41FD53BA839215A37404B17B8FE2586B123557F09D201B13C7736C736B096
Malicious:	false
Reputation:	unknown
Preview:	..........U.h.8...i.@...j.J...k.Y...l.d...n.l...o.q...p.~...r.....s.....t.....v.....w.....y.....z.....\|.....}........................................... .....'.....(.....).....+.............................&.....O.....~.........................................9.....g.............................1.....H.............................<.....T.....b......................./.....h.....p.........................................+.....].......................t.................................../.....T.....m.......................:.....].....n.................>.........................................".....E.....h.............................#.....&.....'.....C.....].....o.................4...........X.....h...........>.....x.................7.....P.....d.....w......................./.....................................................V.....k... .~...".....%.....(.....*.s...+.v...,.........../.....0.3...1.....3.....4.!...5._...6.....7.....8.=...9.\...;.....<.....=.....>.....?.....@.>...A.~...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	331921
Entropy (8bit):	5.529632303060999
Encrypted:	false
SSDEEP:	6144:k6QL0f35ubiwMP9egutWbfaYX2YBB5HXSdBruC:6LduwMetW92M53SuC
MD5:	825ED4C70C942939FFB94E77A4593903
SHA1:	7A3FAEE9BF4C915B0F116CB90CEC961DDA770468
SHA-256:	E11E8DB78AE12F8D735632BA9FD078EC66C83529CB1FD86A31AB401F6F833C16
SHA-512:	41325BEC22AF2E5EF8E9B26C48F2DFC95763A249CCB00E608B7096EC6236AB9A955DE7E2340FD9379D09AC2234AEE69AED2A24FE49382FFD48742D72A929C56A
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.....j.....k.....l.....n.....o.#...p.0...r.6...s.G...t.P...v.e...w.r...y.x...z.....\|.....}.....................................................................................$.....4.....;.....D.....[.....c.....m.......................................................................&.....A.....S.....b.....\|.......................................................................(.....,...../.....5.....E.....T.....b.....{.............................................................................$.....S.....].....i.................................................................0.....@.....P.....e.....z.............................................................................A.....H.....x.............................................................................@.....U.....l............................................. .....".....%.....(.....*.6...+.9...,.W.....h.../.v...0.....1.....3.....4.....5.....6.....7.....8.C...9.P...;.a...<.i...=.t...>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	334693
Entropy (8bit):	5.521172766448584
Encrypted:	false
SSDEEP:	6144:Mvneu710gxhmrunGeuMP9eczCPMfaYbg3In5N+Sqn8BcwS:Ml0gxvNuMbCPmgA5YSNcwS
MD5:	19D18F8181A4201D542C7195B1E9FF81
SHA1:	7DEBD3CF27BBE200C6A90B34ADACB7394CB5929C
SHA-256:	1D20E626444759C2B72AA6E998F14A032408D2B32F957C12EC3ABD52831338FB
SHA-512:	AF07E1B08BBF2DD032A5A51A88EE2923650955873753629A086CAD3B1600CE66CA7F9ED31B8CA901C126C10216877B24E123144BB0048F2A1E7757719AAE73F2
Malicious:	false
Reputation:	unknown
Preview:	........&...h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................!.....(...../.....0.....1.....6.....^.....k.....z................................................................. .....0.....G.....K.....V.....f.....m.....y.................................................................C.....V.....Z.....b.....n.....{.............................................................................$.....+.....1.....:.....E.....b.....i.....x.........................................3.....<.....E.....O.....].....p.....s...............................................................................................@.....m...........................................................%................>.....X.....q.....................................................&......... .2...".;...%.[...(.r........+.....,.........../.....0.....1.....3.....4.)...5.@...6.r...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.!.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	404903
Entropy (8bit):	5.392122812912978
Encrypted:	false
SSDEEP:	3072:75rkwZKG5KJo0ZyFPK9zj4rMY4rjyujd8pyPWncpwwfNEOv553l50GLFddhRIHKj:t1K2YZIK9BYgapFGl5dLFddA7Fcp
MD5:	7DA3E8AA47BA35D014E1D2A32982A5BB
SHA1:	8E35320B16305AD9F16CB0F4C881A89818CD75BB
SHA-256:	7F85673CF80D1E80ACFC94FB7568A8C63DE79A13A1BB6B9D825B7E9F338EF17C
SHA-512:	1FCA90888EB067972BCCF74DD5D09BB3FCE2CEB153589495088D5056ED4BDEDE15D54318AF013C2460F0E8B5B1A5C6484ADF0ED84F4B0B3C93130B086DA5C3BF
Malicious:	false
Reputation:	unknown
Preview:	..........=.h.h...i.q...j.}...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^...........................................................'.....>.....@.....D.....p...........................................................(.....H.....b.....g.....o.........................................#.....9.....N.....T.....W.....].....t...................................@.....P.....V.....^.....e.....x...............................................&.....2.....a.................................................................1.....I....._.....f.....i.....j.....s.....\|.............................0.....t.....\|.......................3.....B.....\.....m.....x..............................................I............................................. .....".....%.(...(.A....]...+.`...,.~........./.....0.....1.....3.....4.3...5.V...6.....7.....8.....9.....;.....<.....=.....>.!...?.+...@.@...A.s...C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	404348
Entropy (8bit):	5.362527979144936
Encrypted:	false
SSDEEP:	6144:/Q0DA42b4XUx+SCHgfUcp9Ch48BKjbu5mrj7o2oxjm6PZqJ:YK2b40P9pchXgjbu5mrroNSJ
MD5:	04A9BA7316DC81766098E238A667DE87
SHA1:	24D7EB4388ECDFECADA59C6A791C754181D114DE
SHA-256:	7FA148369C64BC59C2832D617357879B095357FE970BAB9E0042175C9BA7CB03
SHA-512:	650856B6187DF41A50F9BED29681C19B4502DE6AF8177B47BAD0BF12E86A25E92AA728311310C28041A18E4D9F48EF66D5AD5D977B6662C44B49BFD1DA84522B
Malicious:	false
Reputation:	unknown
Preview:	..........J.h.N...i.V...j.b...k.q...l.\|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}........................."..........1.....8.....?.....@.....A.....C.....r...........................................................2.....4.....8.....`.................................................................:.....T.....Y.....a.....s...............................................&.....,...../.....5.....L.....k............................. .....0.....6.....>.....E.....X.....e.....v...............................................F.....m.....x.................................................................B.....I.....L.....M.....V....._.....h.....o.......................k.....s.......................).....8.....R.....c.....n.....z.........................................2.....f....................................... .....".....%.....(.!....@...+.C...,.a.....{.../.....0.....1.....3.....4.....5."...6.n...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.B...C.i...D.s.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	365447
Entropy (8bit):	5.471951090286899
Encrypted:	false
SSDEEP:	6144:U/RGRpph+2n4x6i05L9H4h+JbT/R/WiMMn5bjN43qcLQ6PQX:8R6pHnpcmzn5bjh
MD5:	CCC71F88984A7788C8D01ADD2252D019
SHA1:	6A87752EAC3044792A93599428F31D25DEBEA369
SHA-256:	D69489A723B304E305CB1767E6C8DA5D5D1D237E50F6DDC76E941DCB01684944
SHA-512:	D35CCD639F2C199862E178A9FAB768D7DB10D5A654BC3BC1FAB45D00CEB35A01119A5B4D199E2DB3C3576F512B108F4A1DF7FAF6624D961C0FC4BCA5AF5F0E07
Malicious:	false
Reputation:	unknown
Preview:	..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....................................................+.....b.....x.....z.....~.....................................................3.....C.....U.....k.....x.....~................................................................. .....#..........>.....Q.....c.....\|.................................................................(.....3.....?.....f.....s.....................................................1.....4.....D.....T.....c.....x.......................................................................S...................................5.....A.....L.....P.....Z....._.....b.....r...................................3.....M.....R.....Z.....l............... .....".....%.....(..........+.....,.<.....V.../.n...0.{...1.....3.....4.....5.....6.....7.5...8.N...9.a...;.t...<.....=.....>.....?.....@.....A.....C.....D.%.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	591476
Entropy (8bit):	5.080621083768775
Encrypted:	false
SSDEEP:	12288:HniDys0XVX9nuyaXTfwIDwNUWGOGfStQvjy1feKtDmrwMTAKzIxRAQiHedNu36Xp:HneM3uyaXTfwewNUWGOGfStQvjy1feKn
MD5:	2E37FD4E23A1707A1ECCEA3264508DFF
SHA1:	E00E58ED06584B19B18E9D28B1D52DBFC36D70F3
SHA-256:	B9EE861E1BDECFFE6A197067905279EA77C180844A793F882C42F2B70541E25E
SHA-512:	7C467F434EB0CE8E4A851761AE9BD7A9E292AAB48E8E653E996F8CA598D0EB5E07EC34E2B23E544F3B38439DC3B8E3F7A0DFD6A8E28169AA95CEFF42BF534366
Malicious:	false
Reputation:	unknown
Preview:	........^...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...........................................................'.....Q.....`.....i..................................."..........R.....u.........................................Q.....y.........................................(...........................................................K.....l.......................,....._.....z..........................................................._.....v.............................K.....g.....v.........................................(.....I.....a.....~.....................................................F........... .....3............................B.....c.....k.....~...................................X.....~.................#.....-.....3.....M.....{......... .....".....%.....(.....*.\...+._...,.}........./.....0.....1.....3.....4._...5.....6.....7.)...8.b...9.{...;.....<.....=.....>.....?.....@.....A.E...C.....D.....E...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	374471
Entropy (8bit):	5.4357475905490436
Encrypted:	false
SSDEEP:	6144:sMeOXrZx5SkDbhCwx+sk/bOE/BanTLLE5lJucHcEJ18OWUczfSUWcX1wR2:snAr15wRBaA5lJxHcEJ18OWUII2
MD5:	21E534869B90411B4F9EA9120FFB71C8
SHA1:	CC91FFBD19157189E44172392B2752C5F73984C5
SHA-256:	2D337924139FFE77804D2742EDA8E58D4E548E65349F827840368E43D567810B
SHA-512:	3CA3C0ADAF743F92277452B7BD82DB4CF3F347DE5568A20379D8C9364FF122713BEFD547FBD3096505EC293AE6771ADA4CD3DADAC93CC686129B9E5AACF363BD
Malicious:	false
Reputation:	unknown
Preview:	........k...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}...........................................................................................)...../.....8.....U.....\.....l.........................................".....'.....5.....?.....N.....Z........................................................... .....-.....5.....<.....N.....f.....j.....t.....z.........................................7.....A.....F.....N.....U.....a.....n.....{.............................................../.....Q.....Y.....i.....u......................................................................................... .....'.....6.............................b.....t...........................................................(.....D.....f.....}................................................... .....".2...%.^...(.{...*.....+.....,.........../.....0.....1.:...3.H...4.d...5.~...6.....7.....8.....9.....;.0...<.@...=.L...>.b...?.k...@.....A.....C.....D.....E...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	419886
Entropy (8bit):	5.213443304857257
Encrypted:	false
SSDEEP:	6144:BnI+f5Qm2xaVyEDQftIK9bSNxeFXGvZ3Omy5GzmHYFAk1s8:C+f541e+b4xy5ym8
MD5:	D7DF2EA381F37D6C92E4F18290C6FFE0
SHA1:	7CACF08455AA7D68259FCBA647EE3D9AE4C7C5E4
SHA-256:	DB4A63FA0D5B2BABA71D4BA0923CAED540099DB6B1D024A0D48C3BE10C9EED5A
SHA-512:	96FC028455F1CEA067B3A3DD99D88A19A271144D73DFF352A3E08B57338E513500925787F33495CD744FE4122DFF2D2EE56E60932FC02E04FEED2EC1E0C3533F
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.....j.....k.-...l.8...n.@...o.E...p.R...r.X...s.i...t.r...v.....w.....y.....z.....\|.....}.........................................................................).....6.....K.....a.....h.....q.....................................................'.....D.....J.....[.....q.....{...............................................#.....5.....N.....d...........................................................$.....8.....Q.....v.................................................................,.....7.....W.........................................4.....D.....R.....`.....u...............................................-.....4.....7.....8.....B.....L.....V.....a.....j.....{.................T.....\........................................."...../.....9.....?.....X.....~.............................C.....b.....i.....t..................... .....".....%.....(......5...+.8...,.V.....n.../.....0.....1.....3.....4.....5.....6.I...7._...8.{...9.....;.....<.....=.....>.....?.....@.....A..

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	436450
Entropy (8bit):	5.4004782148030905
Encrypted:	false
SSDEEP:	12288:LKi1uIt6QuagV1ZzosmZ7MYnYV1S3Bb5MxlqE0wC5wZLljHnkH0oR5FEu64JGV7h:qVVQ515CF
MD5:	3EE48A860ECF45BAFA63C9284DFD63E2
SHA1:	1CB51D14964F4DCED8DEA883BF9C4B84A78F8EB6
SHA-256:	1923E0EDF1EF6935A4A718E3E2FC9A0A541EA0B4F3B27553802308F9FD4FC807
SHA-512:	EB6105FACA13C191FEF0C51C651A406B1DA66326BB5705615770135D834E58DEE9BED82AA36F2DFB0FE020E695C192C224EC76BB5C21A1C716E5F26DFE02F763
Malicious:	false
Reputation:	unknown
Preview:	.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....\|.....}............................................................. .....".....G.....W.....e.....w...........................................................+.....>.....\.....c.....q.........................................#.....?.....A.....T.....h.....t...........................................................+.....=.....N.....r...........................................................(.....G.....O....._.........................................H.....Z.....d.....q.....................................................!.....(.....+.....,.....4.....<.....E.....L....._.................#..........j...........................................................#.....H.....d.......................2.....I.....P.....Y.....j............... .....".....%.....(..........+.....,.-.....D.../.i...0.w...1.....3.....4.....5.....6.Q...7.b...8.z...9.....;.....<.....=.....>.....?.....@.....A.G...C.n...D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	832533
Entropy (8bit):	4.370164270379204
Encrypted:	false
SSDEEP:	3072:RqlNvTn1Pdm06M0ITsKMaWZKerbtsMhmksd4Mqz2sQmB51jvjsWnhAgfZw/g/I/f:RuN7n1VQFLFwsL5cqhgrA8
MD5:	308619D65B677D99F48B74CCFE060567
SHA1:	9F834DF93FD48F4FB4CA30C4058E23288CF7D35E
SHA-256:	E40EE4F24839F9E20B48D057BF3216BC58542C2E27CB40B9D2F3F8A1EA5BFBB4
SHA-512:	3CA84AD71F00B9F7CC61F3906C51B263F18453FCE11EC6C7F9EDFE2C7D215E3550C336E892BD240A68A6815AF599CC20D60203294F14ADB133145CA01FE4608F
Malicious:	false
Reputation:	unknown
Preview:	..........T.h.:...i.T...j.`...k.o...l.z...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}......................... .....(...../.....6.....=.....>.....?.....D.......................0.....E.....[.......................+.....c.....e.....q.......................8.....p...................................Q...................................<.....X.................%.....>.....c........................................U.......................w...............................................g.....v.......................Q.................D.............................%.....O.....R.....r.............................+.....2.....5.....7.....P.....i.......................H...........\.....~...........S.................%.....E.....N.....o.....{.......................O.................;............................M.....o......... .....".....%.....(.Y...*.....+.....,.........../.1...0.Y...1.....3.....4.....5.;...6.....7.....8.,...9.T...;.....<.....=.....>.....?.....@.0...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	519468
Entropy (8bit):	4.6902065244805256
Encrypted:	false
SSDEEP:	12288:iDIJk5rUp/mTLa2/ANNqOL607Af6XVjeQCapb1527oFpMbe54lmdADnwg5Qgx:7205KoM
MD5:	FC84EA7DC7B9408D1EEA11BEEB72B296
SHA1:	DE9118194952C2D9F614F8E0868FB273DDFAC255
SHA-256:	15951767DAFA7BDBEDAC803D842686820DE9C6DF478416F34C476209B19D2D8C
SHA-512:	49D13976DDDB6A58C6FDCD9588E243D705D99DC1325C1D9E411A1D68D8EE47314DFCB661D36E2C4963C249A1542F95715F658427810AFCABDF9253AA27EB3B24
Malicious:	false
Reputation:	unknown
Preview:	........\|.\|.h.....i.....j.....k.....l.!...n.)...o.....p.;...r.A...s.R...t.[...v.p...w.}...y.....z.....\|.....}.........................................................................8.....O.....h............................................... .....".....&.....N.....j.........................................B.....[.....p...............................................G.....o.....w...............................................).....E.....y.............................$.....,.....3.....?.....V.....r...................................!.....D.....h...................................7.....W.....Z.....m............................................................................./.................e.....o.......................E.....X.....p.....v.........................................@.....Z...................................#.....J.....U... .g...".....%.....(.....*.....+.....,.......#.../.C...0.P...1.....3.....4.....5.....6.9...7.R...8.g...9.{...;.....<.....=.....>.....?.....@.....A.x...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	868673
Entropy (8bit):	4.359937106090665
Encrypted:	false
SSDEEP:	3072:FugBVdK+X9c+XdfdkhSvf4QAEm5dmGrsUt3GR3GXO7NLdYnLsBPtv83ctKOf4z8d:cuVAsc+NZB5/5MNSD
MD5:	B5DFCE8E3BA0AEC2721CC1692B0AD698
SHA1:	C5D6FA21A9BA3D526F3E998E3F627AFB8D1EECF3
SHA-256:	B1C7FB6909C8A416B513D6DE21EEA0B5A6B13C7F0A94CABD0D9154B5834A5E8B
SHA-512:	FACF0A9B81AF6BB35D0FC5E69809D5C986A2C91A166E507784BDAD115644B96697FE504B8D70D9BBB06F0C558F746C085D37E385EEF41F0A1C29729D3D97980F
Malicious:	false
Reputation:	unknown
Preview:	........y...h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....\|.....}.........................................................................t...................................A.....d.....~.............................4.....c...................................d.......................l...................................J........... .....9.....H.....p...................................P.......................g.........................................+.....K.......................P.....u.......................l.......................9.....b...................................C.....m...............................................#.....D.................&.....<.................N.................................../.....A.....s................................................................R.....q... .....".....%.....(.6....s...+.v...,.........../.....0.5...1.....3.....4.....5.@...6.....7.....8.:...9._...;.....<.....=.....>.....?.....@.8...A.\|...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	406671
Entropy (8bit):	5.521226257186607
Encrypted:	false
SSDEEP:	3072:z9mYpq0ZkIEZgVRTJ3MOS+WG0uPXbG4TT6WI6DkYAiKbeM/wXbnWNjdmvW0IEifp:zTEgNmW/5tE7IDjG
MD5:	255F808210DBF995446D10FF436E0946
SHA1:	1785D3293595F0B13648FB28AEC6936C48EA3111
SHA-256:	4DF972B7F6D81AA7BDC39E2441310A37F746AE5015146B4E434A878D1244375B
SHA-512:	8B1A4D487B0782055717B718D58CD21E815B874E2686CDFD2087876B70AE75F9182F783C70BF747CF4CA17A3AFC68517A9DB4C99449FA09BEF658B5E68087F2A
Malicious:	false
Reputation:	unknown
Preview:	..........<.h.j...i.{...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....h...........................................................:.....K.....M.....Q.....y...........................................................-.....D.....T.....Z.....b.....p.......................................................................&.....8.....H.....].....z...........................................................&.....1.....H.....................................................'.....2.....F.....g.....j.....z...................................................................................`.......................;.....W.....p.....................................................6.....N............................................... .....B.....M... .W...".h...%.....(..........+.....,.........../.....0.....1.O...3.a...4.~...5.....6.....7.....8.....9.0...;.>...<.K...=.W...>.l...?.u...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	437458
Entropy (8bit):	5.655020135928055
Encrypted:	false
SSDEEP:	6144:wxEAuskhSSfm4Cky1tV5z8iZfGRzEY63aQSam7gXOeeeQi5gR7azQtGV52n5ydpS:wxLaj6V5z850+7BwQi5Rn6Z
MD5:	2AA0A175DF21583A68176742400C6508
SHA1:	3C25BA31C2B698E0C88E7D01B2CC241F0916E79A
SHA-256:	B59F932DF822AB1A87E8AAB4BBB7C549DB15899F259F4C50AE28F8D8C7CE1E72
SHA-512:	03A16FEB0601407E96BCB43AF9BDB21E5218C2700C9F3CFD5F9690D0B4528F9DC17E4CC690D8C9132D4E0B26D7FAAFD90AA3F5E57237E06FB81AAB7AB77F6C03
Malicious:	false
Reputation:	unknown
Preview:	..........j.h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....\|.....}.........................................................................L.....\.....r...............................................,...........2.....Z.....y.....................................................-.....X.....p.....u.....{.........................................!.....9.....X.....\....._.....m...................................@.....c.................................................................7.....B.....Z.....h.....................................................,.....A.....[.....{.................................................................q...........5.....;...................................#.....+.....9.....A.....G.....^.............................>.....u....................................... .....".....%.5...(.R...*.x...+.{...,.........../.....0.....1.....3.....4.6...5.X...6.....7.....8.....9.....;.....<.....=.....>.(...?.5...@.H...A.p...C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	359190
Entropy (8bit):	5.384547702191974
Encrypted:	false
SSDEEP:	6144:UINLZJl/dv1DR9S2fjDVnjHFfRmP2x1r856Rh1vtTtSLsEar:Nf7PDuAVnjHFpm+xh856RhP
MD5:	B6FCD5160A3A1AE1F65B0540347A13F2
SHA1:	4CF37346318EFB67908BBA7380DBAD30229C4D3D
SHA-256:	7FD715914E3B0CF2048D4429F3236E0660D5BD5E61623C8FEF9B8E474C2AC313
SHA-512:	A8B4A96E8F9A528B2DF3BD1251B72AB14FECCF491DD254A7C6ECBA831DFABA328ADB0FD0B4ACDDB89584F58F94B123E97CAA420F9D7B34131CC51BDBDBF3ED73
Malicious:	false
Reputation:	unknown
Preview:	.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....\|.....}............................................................. .....".....E.....S.....`.....p.....w.................................................................3.....;.....I.....Y.....a.....n.................................................................;.....P.....W.....^.....p.....}...........................................................0.....>.....C.....K.....R.....W.....a.....l...............................................$.....R.....x.................................................................'.....8.....?.....B.....C.....K.....S.....[.....c.....i.....u.............................@.....Q.....a.................................................................%.....:.....T............................................. .....".....%.....(.+...*.D...+.G...,.e.....u.../.....0.....1.....3.....4.....5.....6.5...7.H...8.\...9.i...;.w...<.....=.....>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	397402
Entropy (8bit):	5.301296912236702
Encrypted:	false
SSDEEP:	6144:n9BKi2azctogSrqRrhsO11GT9TeLAG3XRU2gY7OfLwH+WcMgB8HryeuRNBPJX9SO:n9FTnzZY28+2vx+0e55zoI
MD5:	745F16CA860EE751F70517C299C4AB0E
SHA1:	54D933AD839C961DD63A47C92A5B935EEF208119
SHA-256:	10E65F42CE01BA19EBF4B074E8B2456213234482EADF443DFAD6105FAF6CDE4C
SHA-512:	238343D6C80B82AE900F5ABF4347E542C9EA016D75FB787B93E41E3C9C471AB33F6B4584387E5EE76950424E25486DD74B9901E7F72876960C0916C8B9CEE9A6
Malicious:	false
Reputation:	unknown
Preview:	..........Q.h.@...i.Q...j.]...k.l...l.w...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....i.....\|.......................................................................C.....V.....w.....~................................................................C.....Y.....o.................................................................0.....D.....f......................................................................2.....@.....v............................................... .....,.....?.....T.....W.....k...................................................................................b.......................:.....O.....d.................................................................K.....k................................................... .....".$...%.H...(.`...*.\|...+.....,.........../.....0.....1.....3.(...4.H...5.f...6.....7.....8.....9.....;.....<.....=. ...>.K...?.V...@.g...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	484003
Entropy (8bit):	5.752575429591325
Encrypted:	false
SSDEEP:	3072:fznG4qRo+yixrD1r04XURrRpZd2hy/NPNQPkwRI6dIKhUNH7bbeCsy5SWbaabF/G:fzGBRo+911WlRpZd2yNp6k5AYxVk
MD5:	38CD3EF9B7DFF9EFBBE086FA39541333
SHA1:	321EF69A298D2F9830C14140B0B3B0B50BD95CB0
SHA-256:	D8FAB5714DAFECB89B3E5FCE4C4D75D2B72893E685E148E9B60F7C096E5B3337
SHA-512:	40785871032B222A758F29E0C6EC696FBE0F6F5F3274CC80085961621BEC68D7E0FB47C764649C4DD0C27C6EE02460407775FAE9D3A2A8A59362D25A39266CE0
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.....j.....k.....l.....m.....o.1...p.>...v.D...w.Q...y.W...z.f...\|.l...}.~.........................................................................................3.....Q.....r.....x.............................(.....I.....K.....O.....w.........................................#.....J.....Z.....u..............................................._...........................................................9.....c.......................#.....3.....<.....D.....K.....T.....i.....y.............................B.....c................................... .....D.....G.....V.....q.....................................................$.....1.....D.................z.......................&.....Y.....h.....................................................7.....O...................................#.....C.....I... .R...".d...%.....(.....*.....+.....,.......J.../.h...0.q...1.....3.....4.....5.....6.g...7.....8.....9.....;.....<.....=.....>.:...?.D...@.Y...A.....C.....D.....E.....F.0...G.Z.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	960888
Entropy (8bit):	4.2704203524429865
Encrypted:	false
SSDEEP:	12288:P8nyRnHoS7yB/rt2o6i7u7b5frUb+7G+Vma:ti6X5jUA
MD5:	CAAB4DEB1C40507848F9610D849834CF
SHA1:	1BC87FF70817BA1E1FDD1B5CB961213418680CBE
SHA-256:	7A34483E6272F9B8881F0F5A725B477540166561C75B9E7AB627815D4BE1A8A4
SHA-512:	DC4B63E5A037479BB831B0771AEC0FE6EB016723BCD920B41AB87EF11505626632877073CE4E5E0755510FE19BA134A7B5899332ECEF854008B15639F915860C
Malicious:	false
Reputation:	unknown
Preview:	..........7.h.t...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....u...........>.....u.......................F.....g.....y...........<.....>.....J.....r.......................^.......................e.................1.....n.....................................................1.....l.....{.....~.................,.....l............................-.....E.....M.....T.....f.............................I.......................S.................d.............................`.....c.......................E...............................................#.....6.....`.................".....=.................(...............................................@.............................".......................(.....h............... ....."."...%.....(..........+.....,.;.....l.../.....0.....1.U...3.o...4.....5.....6.....7.....8.....9.V...;.....<.....=.....>.....?.....@.G...A.....C.....D.=.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	407632
Entropy (8bit):	6.124197697056213
Encrypted:	false
SSDEEP:	12288:Md9PhJeKVoCGet8Oh2J7klCqZ5T7BKI8LtCq7hUoqAX:Md91UJc5184AX
MD5:	D6194FC52E962534B360558061DE2A25
SHA1:	98ED833F8C4BEAC685E55317C452249579610FF8
SHA-256:	1A5884BD6665B2F404B7328DE013522EE7C41130E57A53038FC991EC38290D21
SHA-512:	5207A07426C6CEB78F0504613B6D2B8DADF9F31378E67A61091F16D72287ADBC7768D1B7F2A923369197E732426D15A872C091CF88680686581D48A7F94988AB
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.....j.....k.....l.....m.....o.....p.....r.....s.-...t.6...y.K...z.Z...\|.`...}.r.....z.........................................................................................7.....D.....^.....k.....s.........................................3.....?.....L.....\.....c.....}.................................................................d.....z.................................................................%.....F.....j.......................................................................`.....v..................................6.....L.....Y.....n.........................................................................................x...........D.....M.............................#.....6.....9.....L.....R.....[.....r...................................^.....n.....w.....}..................... .....".....%.....(......M...+.P...,.........../.....0.....1.....3.....4.5...5.]...6.....7.....8.....9.....;.....<.....=.....>.....?./...@.C...A.q...C.....D.....E.....F.....G...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	439793
Entropy (8bit):	5.6365541871793114
Encrypted:	false
SSDEEP:	6144:zXtEPi5jFX4VU4EzsnHIOBoU+1Qi7t5GkzvLdyaj+teJvxY2I96Su:CEmguHLBoUnU5TzvLWeJJG6Su
MD5:	64B08FFC40A605FE74ECC24C3024EE3B
SHA1:	516296E8A3114DDBF77601A11FAF4326A47975AB
SHA-256:	8A5D6E29833374E0F74FD7070C1B20856CB6B42ED30D18A5F17E6C2E4A8D783E
SHA-512:	05D207413186AC2B87A59681EFE4FDF9DC600D0F3E8327E7B9802A42306D80D0DDD9EE07D103B17CAF0518E42AB25B7CA9DA4713941ABC7BCED65961671164AC
Malicious:	false
Reputation:	unknown
Preview:	..........S.h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....h.....v...............................................&.....7.....9.....=.....e.....................................................(.....7.....Q.....f.....m.....v.....................................................6.....A.....L.....V.....l............................. .....G.....e.....n.....v.....}...............................................).....4.....K.....]................................................................./.....G.....^.....x...........................................................Y....................... .....A.....w....................................................>.....r...............................................L.....Y... .n...".~...%.....(..........+.....,.......6.../.Q...0.T...1.....3.....4.....5.....6.-...7.P...8.p...9.....;.....<.....=.....>.....?.....@.....A.I...C.j.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	437670
Entropy (8bit):	5.638618522703661
Encrypted:	false
SSDEEP:	6144:TjewdtAe6tN4tVFHzmstt4Uoo3W3sb3F5hZanXnEv9AhraszLOAty6ls1V:RR/v4UVWwF5UEabns1V
MD5:	A8CBD741A764F40B16AFEA275F240E7E
SHA1:	317D30BBAD8FD0C30DE383998EA5BE4EEC0BB246
SHA-256:	A1A9D84FD3AF571A57BE8B1A9189D40B836808998E00EC9BD15557B83D0E3086
SHA-512:	3DA91C0CA20165445A2D283DB7DC749FCF73E049BFFF346B1D79B03391AEFC7F1310D3AC2C42109044CFB50AFCF178DCF3A34B4823626228E591F328DD7AFE95
Malicious:	false
Reputation:	unknown
Preview:	..........C.h.\...i.m...j.y...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z...........................................................3.....O.....Q.....U.....}...........................................................7.....Q.....b.....h.....n.....................................................,.....5.....8.....?.....U.....g.....y...........................................................'.....@.....c.....g.........................................9.....[.....l...........................................................1.....H.....O.....R.....S.....].....h.....p.....w.......................].....h.......................8.....C.....U.....\.....k.....n.....y...................................S............................................. .....".....%.'...(.A...*.^...+.a...,.........../.....0.....1.....3.....4.,...5.Q...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.i...C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	998155
Entropy (8bit):	4.3110320925732095
Encrypted:	false
SSDEEP:	12288:T6ALnHOE47/URV1BQMmWDcZubSAD7qcDs3eThx5D/7dZdO3cb:9Owoys3eT5D/79O3u
MD5:	1C81104AC2CBF7F7739AF62EB77D20D5
SHA1:	0F0D564F1860302F171356EA35B3A6306C051C10
SHA-256:	66005BC01175A4F6560D1E9768DBC72B46A4198F8E435250C8EBC232D2DAC108
SHA-512:	969294EAE8C95A1126803A35B8D3F1FC3C9D22350AA9CC76B2323B77AD7E84395D6D83B89DEB64565783405D6F7EAE40DEF7BDAF0D08DA67845AE9C7DBB26926
Malicious:	false
Reputation:	unknown
Preview:	..........:.h.n...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.................Z.......................1.....O.................k.....m.....q.......................E.............................x.................Y.............................+....._...........6.....T.....{.............................5.......................u...........,.........................................#.....K...............................................:...........,.....f.............................".....f.......................O.....................................................i................._.....}.......................`.........................................s...........T...........&...........l.......................H.....s......... .....".....%.....(.....*.T...+.W...,.........../.....0.....1.....3.....4.....5.v...6.....7.R...8.....9.....;.S...<.p...=.....>.....?.....@.....A.U...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	816652
Entropy (8bit):	4.350418506868822
Encrypted:	false
SSDEEP:	3072:ZE7bv9/9xAvtACKjxUp0djbOXspvibMFFPMUh3RQR3KB+5lx14/H4bmHwMaZ0t4k:ZE7b1fOACsxZjAEV6yZ00VbJ5JgezP5
MD5:	2CF9F07DDF7A3A70A48E8B524A5AED43
SHA1:	974C1A01F651092F78D2D20553C3462267DDF4E9
SHA-256:	23058C0F71D9E40F927775D980524D866F70322E0EF215AA5748C239707451E7
SHA-512:	0B21570DEEFA41DEFC3C25C57B3171635BCB5593761D48A8116888CE8BE34C1499FF79C7A3EBBE13B5A565C90027D294C6835E92E6254D582A86750640FE90F2
Malicious:	false
Reputation:	unknown
Preview:	........\|.\|.h.....i.....j.....k.....l....n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.........................................................................q...................................5.....G.....Y.............................<.....a.......................,.....B.....w.......................^.....}.................................................................D.....M.....P.....l.......................A.......................<.....O.....W.....^.....j.............................2.............................J.......................P.....s...................................-.....N.....r.....................................................2...........b...................................K.....d.........................................@.................,.....m.......................:.....]............... .....".....%.J...(..........+.....,.......!.../.]...0.j...1.....3.....4.4...5.n...6.....7.....8.X...9.....;.....<.....=.....>.%...?.8...@.g...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	374453
Entropy (8bit):	5.272284824619555
Encrypted:	false
SSDEEP:	6144:DZ/AO2kUDrt2MBrIxFQJulcul5WkS/PSOW5soNY3MMyvek:DZ/ApkUDrt2MOxSIl51kP05RYcMA
MD5:	AEE105366A1870B9D10F0F897E9295DB
SHA1:	EEE9D789A8EEAFE593CE77A7C554F92A26A2296F
SHA-256:	C6471AEE5F34F31477D57F593B09CB1DE87F5FD0F9B5E63D8BAB4986CF10D939
SHA-512:	240688A0054BFEBE36EA2B056194EE07E87BBBEB7E385131C73A64AA7967984610FCB80638DD883837014F9BC920037069D0655E3E92A5922F76813AEDB185FA
Malicious:	false
Reputation:	unknown
Preview:	..........8.h.r...i.z...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j...........................................................A.....X.....Z.....^...........................................................+.....9.....M.....Z.....a.....f.....u............................................................................9.....M.....d.......................................................................$.....6.....d.....x.....................................................).....=.....@.....T.....h.....z...................................................................................e...................................$...../.....A.....L.....V.....^.....e.....\|...................................1.....F.....L.....R.....a.....v......... .....".....%.....(..........+.....,.......$.../.:...0.D...1.x...3.....4.....5.....6.....7.....8.&...9.9...;.M...<.X...=.i...>.....?.....@.....A...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	367614
Entropy (8bit):	5.435724855090923
Encrypted:	false
SSDEEP:	6144:TAJxNH0uqnIhgFYMqOp7fwcbgtmX07Sgzuu5Dn4XYnOGrr:ExdfqnPFYMqOp7fwcwSgB5Dn4LGrr
MD5:	55D5AD4EACB12824CFCD89470664C856
SHA1:	F893C00D8D4FDB2F3E7A74A8BE823E5E8F0CD673
SHA-256:	4F44789A2C38EDC396A31ABA5CC09D20FB84CD1E06F70C49F0664289C33CD261
SHA-512:	555D87BE8C97F466C6B3E7B23EC0210335846398C33DBA71E926FF7E26901A3908DBB0F639C93DB2D090C9D8BDA48EDDF196B1A09794D0E396B2C02B4720F37E
Malicious:	false
Reputation:	unknown
Preview:	..........P.h.B...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....m.....x.................................................................".....J.....^.....v.....{.....................................................)...../.....5.....D.....T.....c.......................................................................-.....J.....c.....{.......................................................................+.....6.....@.....Y.....o.......................................................................%.....5.....I.....P.....S.....T.....[.....c.....n.....u..................................x...........................................................,.....I.....`.....y...............................................'.....2... .7...".@...%.Z...(.z........+.....,.........../.....0.....1.....3. ...4.:...5.O...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.?...C.\.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	379453
Entropy (8bit):	5.379227569652463
Encrypted:	false
SSDEEP:	6144:KcJ9Smne7gqDO5EQHzpamU3D+qn7Cv5qPxOGpLMsLPW:Km9nCgqDO5ELrOv5qPxOGpLM+PW
MD5:	0F04BAC280035FAB018F634BCB5F53AE
SHA1:	4CAD76EAECD924B12013E98C3A0E99B192BE8936
SHA-256:	BE254BCDA4DBE167CB2E57402A4A0A814D591807C675302D2CE286013B40799B
SHA-512:	1256A6ACAC5A42621CB59EB3DA42DDEEACFE290F6AE4A92D00EBD4450A8B7CCB6F0CD5C21CF0F18FE4D43D0D7AEE87B6991FEF154908792930295A3871FA53DF
Malicious:	false
Reputation:	unknown
Preview:	..........Y.h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........\.....h.....x.................................................................).....A.....].....k.....{...............................................)...........7.....F.....V.....e.................................................................3.....K.....o.................................................................).....0.....E.....}.........................................'.....1.....?.....^.....a.....v.............................................................................).....k.......................+.....@.....X.................................................................3.....H.....f............................................. .....".....%.....(.+....D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.J...7.b...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.8...D.B.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	422325
Entropy (8bit):	5.774687126444438
Encrypted:	false
SSDEEP:	12288:roj98jy/jojSoM/Z+Xgv3iWhbhvPeCUdxUwVTmNF1Qhjhd5UR405Y:ryMV+1Qhb5IY
MD5:	F1D48A7DCD4880A27E39B7561B6EB0AB
SHA1:	353C3BA213CD2E1F7423C6BA857A8D8BE40D8302
SHA-256:	2593C8B59849FBC690CBD513F06685EA3292CD0187FCF6B9069CBF3C9B0E8A85
SHA-512:	132DA2D3C1A4DAD5CCB399B107D7B6D9203A4B264EF8A65ADD11C5E8C75859115443E1C65ECE2E690C046A82687829F54EC855F99D4843F859AB1DD7C71F35A5
Malicious:	false
Reputation:	unknown
Preview:	..........R.h.>...i.O...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....:.....j.....y.....................................................!.....#.....'.....O.....g......................................................................0.....6.....I.....].....o.............................................................................J.....f.............................................................................K....._.....j.....................................................<.....?.....N.....\.....k.......................................................................9.......................(.....E.....`.....................................................#.....=.....k...............................................9.....D... .M...".]...%.....(..........+.....,.........../.....0."...1.Q...3.`...4.....5.....6.....7.....8.....9.....;.&...<.1...=.;...>.O...?.X...@.k...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	399250
Entropy (8bit):	5.432001310431886
Encrypted:	false
SSDEEP:	6144:oNssFqCoNBXBL3sNA65VyS15LqJVlLUoR1peV:oNssFqIF5uJH4oR/g
MD5:	8E931FFBDED8933891FB27D2CCA7F37D
SHA1:	AB0A49B86079D3E0EB9B684CA36EB98D1D1FD473
SHA-256:	6632BD12F04A5385012B5CDEBE8C0DAD4A06750DC91C974264D8FE60E8B6951D
SHA-512:	CF0F6485A65C13CF5DDD6457D34CDEA222708B0BB5CA57034ED2C4900FD22765385547AF2E2391E78F02DCF00B7A2B3AC42A3509DD4237581CFB87B8F389E48D
Malicious:	false
Reputation:	unknown
Preview:	..........=.h.h...i.y...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i...........................................................@.....U.....W.....[...........................................................'.....A.....a.....x...............................................!.....,.....<.....I.....M.....P.....W.....l.....z.....................................................&.....,.....7.....E.....].....g.....x...................................4.....>.....N.....[.....m...................................................................................%.....,.....<.....o.......................&.....;.....R.....z.................................................................G.....e............................................. .....".....%.)...(.?...*.Z...+.]...,.{........./.....0.....1.....3.....4.....5.'...6._...7.s...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.S...D.].

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	400379
Entropy (8bit):	5.412017917472705
Encrypted:	false
SSDEEP:	6144:dqPhA4zslBWfIw2ieJVJJxhmOcXLFIUK5IKM4RV6X:EJolB/2bfK5IKM4RG
MD5:	B4954B064E3F6A9BA546DDA5FA625927
SHA1:	584686C6026518932991F7DE611E2266D8523F9D
SHA-256:	EE1E014550B85E3D18FB5128984A713D9F6DE2258001B50DDD18391E7307B4A1
SHA-512:	CB3B465B311F83B972ECA1C66862B2C5D6EA6AC15282E0094AEA455123DDF32E85DF24A94A0AEDBE1B925FF3ED005BA1E00D5EE820676D7A5A366153ADE90EF7
Malicious:	false
Reputation:	unknown
Preview:	..........2.h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....................................................!.....).....J.....\.....^.....b...........................................................).....<.....W.....o.....y.....................................................'.....4.....8.....;.....B.....[.....i.....z...............................................$..........5.....C.....Y.....a.....r.........................................6.....A.....Q.....^.....p.............................................................................%...........5.....F.............................>.....R.....f...........................................................(.....U.....q............................................... ... .$...".8...%.S...(.i........+.....,.........../.....0.....1.....3.&...4.J...5.n...6.....7.....8.....9.....;.....<.....=.....>.A...?.L...@.a...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	412797
Entropy (8bit):	5.469387509353947
Encrypted:	false
SSDEEP:	6144:Lsg4/xnSFcFG1Y6vFEsif5QB0o1s21/oulzr:Lt7FcFG1Y6vesif5QKob/dr
MD5:	D2758F6ADBAEEA7CD5D95F4AD6DDE954
SHA1:	D7476DB23D8B0E11BBABF6A59FDE7609586BDC8A
SHA-256:	2B7906F33BFBE8E9968BCD65366E2E996CDF2F3E1A1FC56AD54BAF261C66954C
SHA-512:	8378032D6FEBEA8B5047ADA667CB19E6A41F890CB36305ACC2500662B4377CAEF3DC50987C925E05F21C12E32C3920188A58EE59D687266D70B8BFB1B0169A6E
Malicious:	false
Reputation:	unknown
Preview:	..........Z.h.....i.?...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................&.....'.....(..........e.....t.......................................................................2.....S.....p.....y...............................................-.....D.....L....._.....s...............................................2.....=.....E.....b...................................>.....O.....W....._.....f.....l.....{...............................................+.....;.....b...........................................................'.....B.....`.....t.....{.....~...............................................].............................2.....b.....m.....................................................?.....g.........................................#...../... .9...".M...%.p...(..........+.....,.........../.....0.....1.....3.?...4.[...5.{...6.....7.....8.....9.....;.....<.....=.(...>.C...?.K...@.Z...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	672991
Entropy (8bit):	4.887128747074479
Encrypted:	false
SSDEEP:	12288:xkFzEroY5eXN2hHO3j/jHXzvMBJJWkKce8P/XzFGGJn/aZ/LNUFC0WGWajfG1UpM:xUQMi5y6d4
MD5:	2885BDE990EE3B30F2C54A4067421B68
SHA1:	AE16C4D534B120FDD68D33C091A0EC89FD58793F
SHA-256:	9FCDA0D1FAB7FFF7E2F27980DE8D94FF31E14287F58BD5D35929DE5DD9CBCDCA
SHA-512:	F7781F5C07FBF128399B88245F35055964FF0CDE1CC6B35563ABC64F520971CE9916827097CA18855B46EC6397639F5416A6E8386A9390AFBA4332D47D21693F
Malicious:	false
Reputation:	unknown
Preview:	............h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................".....#.....$.....&.....~...................................4.....>.....H.........................................-.....9.....X.....l...................................T.....w.............................E.....o.....y...............................................$.....?.....\|.......................).....7.....?.....M.....n...................................H.....X.......................#.....D.....W.....{...................................<.....^...........................................................r.............................@.....g.............................).....>.....L.....z.................`.....~...........$.....U.....g.....{..................... .....".....%.,...(.r...*.....+.....,.........../.:...0.K...1.....3.....4.....5."...6.....7.....8.....9.....;.....<.1...=.E...>.\|...?.....@.....A.-...C.e...D.v...E.....F...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	426178
Entropy (8bit):	5.821396103086126
Encrypted:	false
SSDEEP:	6144:M43lA0ct/muNypigJ4BOn5aHSL9aQCqoLWGL:91cgsypipBI5aHSL9aQCDLd
MD5:	B7E97CC98B104053E5F1D6A671C703B7
SHA1:	0F7293F1744AE2CD858EB3431EE016641478AE7D
SHA-256:	B0D38869275D9D295E42B0B90D0177E0CA56A393874E4BB454439B8CE25D686F
SHA-512:	EF3247C6F0F4065A4B68DB6BF7E28C8101A9C6C791B3F771ED67B5B70F2C9689CEC67A1C864F423382C076E4CBB6019C1C0CB9AD0204454E28F749A69B6B0DE0
Malicious:	false
Reputation:	unknown
Preview:	..........R.h.>...i.R...j.^...k.m...l.x...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................&.....-.....4.....;.....<.....=.....?.....s.....................................................(.....=.....?.....C.....k.....................................................'.....7.....S.....b.....h.....p...........................................................-.....8.....V.....l.....~...........................................................#.....2.....I.....T.....o...................................8.....B.....P.....\.....k.............................................................................'...../.....;.....K.................?.....F.............................+.....F.....K.....W.....b.....k...................................N............................................. .....".....%.,...(.G...*.h...+.k...,.........../.....0.....1.....3.....4. ...5.?...6.v...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.Z...C.{...D.....E...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	411437
Entropy (8bit):	5.49350335324308
Encrypted:	false
SSDEEP:	6144:tnerKYjnS4fhmi0i2iiBnnbANjbnPMum4ocyxPbPD/yu0zrVftjQLc35BdFPcNpU:lEjnSn1iHd35vtcqO+i/fz50qg
MD5:	CA763E801DE642E4D68510900FF6FABB
SHA1:	C32A871831CE486514F621B3AB09387548EE1CFF
SHA-256:	340E0BABE5FDDBFDA601C747127251CF111DD7D79D0D6A5EC4E8443B835027DE
SHA-512:	E2847CE75DE57DEB05528DD9557047EDCD15D86BF40A911EB97E988A8FDBDA1CD0E0A81320EADF510C91C826499A897C770C007DE936927DF7A1CC82FA262039
Malicious:	false
Reputation:	unknown
Preview:	..........c.h.....i.-...j.7...k.F...l.Q...n.Y...o.^...p.k...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................B.....T.....b.....r.....z.....................................................F.....d.....\|.......................................................................%.....4.....H.....W.......................................................................#.....=.....].....{.....................................................#...........>.....k.....u...............................................'.....6.....P.....U.....e.....x.............................................................................E.......................&.....I.....j.....................................................%.....=.....j...............................................&.....2... .<...".N...%.f...(.....*.....+.....,.........../.....0.....1.I...3.X...4.t...5.....6.....7.....8.....9.....;.#...<./...=.9...>.L...?.V...@.d...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	630964
Entropy (8bit):	4.810757945626649
Encrypted:	false
SSDEEP:	12288:H0JfhK5lIRIS151RHexYzs+DN5W9xTvvWF37sQ/k/k/i:y5V9dN5Oxjn
MD5:	C68C235D8E696C098CF66191E648196B
SHA1:	5C967FBBD90403A755D6C4B2411E359884DC8317
SHA-256:	AB96A18177AF90495E2E3C96292638A775AA75C1D210CA6A6C18FBC284CD815B
SHA-512:	34D14D8CB851DF1EA8CD3CC7E9690EAF965D8941CFCAC1C946606115AD889630156C5FF47011B27C1288F8DF70E8A7DC41909A9FA98D75B691742EC1D1A5E653
Malicious:	false
Reputation:	unknown
Preview:	..........?.h.d...i.u...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.......................#.....=.....X.............................I.....K.....O.....w...................................(.....B.....w.........................................B.....k.............................+.....D....._.....i.....y...................................Q...............................................&.....H.....l.....x.............................B.....e............................./.....O.........................................(.....H.....O.....R.....S.....].....i.......................5...........Q.....a...........1.....^................................... ..........N.......................O............................. .....5.....h.....}... .....".....%.....(.%....W...+.Z...,.x........./.....0.....1.4...3.K...4.....5.....6.$...7.L...8.z...9.....;.....<.....=.....>.!...?.2...@.S...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	370331
Entropy (8bit):	5.550902354924257
Encrypted:	false
SSDEEP:	6144:A3J7MHJrRRcAjowQx+ByxN6dn4bLXvu9M7SOVDE/xUDv6o5WI5ggbN:G7EHl9BdU5X5x
MD5:	272F8A8B517C7283EAB83BA6993EEA63
SHA1:	AD4175331B948BD4F1F323A4938863472D9B700C
SHA-256:	D15B46BC9B5E31449B11251DF19CD2BA4920C759BD6D4FA8CA93FD3361FDD968
SHA-512:	3A0930B7F228A779F727EBFB6AE8820AB5CC2C9E04C986BCE7B0F49F9BF124F349248ECDF108EDF8870F96B06D58DEA93A3E0E2F2DA90537632F2109E1AA65F0
Malicious:	false
Reputation:	unknown
Preview:	..........q.h.....i.....j.....k.,...l.7...n.?...o.D...p.Q...r.W...s.h...t.q...v.....w.....y.....z.....\|.....}.........................................................................(.....9.....K....._.....g.....p.....................................................%.....=.....C.....S.....d.....k.....x.................................................................W.....m.....y.................................................................?.....c.......................................................................,.....4.....?.....W.....g.................................................................".....4.....E.....b.....i.....l.....m.....u.....}.............................&.....`.....g........................................."..........,.....2.....D.....e.....}.............................1.....7.....A.....Q.....`.....h... .m...".w...%.....(..........+.....,.........../.....0.1...1.]...3.g...4.....5.....6.....7.....8.....9.....;.....<.%...=.3...>.J...?.S...@.c...A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	388458
Entropy (8bit):	5.356168167447509
Encrypted:	false
SSDEEP:	6144:24pV6wBz58kN6vhq//3UZFBIzDWs8ADjLKrYNguA/h5aS0DwV+ChZYeeq0e1k4H5:24bVd5B/3U/BLs8kMKguA/h5N1hZY+0u
MD5:	67A443A5C2EAAD32625EDB5F8DEB7852
SHA1:	A6137841E8E7736C5EDE1D0DC0CE3A44DC41013F
SHA-256:	41DFB772AE4C6F9E879BF7B4FA776B2877A2F8740FA747031B3D6F57F34D81DD
SHA-512:	E0FDFF1C3C834D8AF8634F43C2F16BA5B883A8D88DFD322593A13830047568FAF9F41D0BF73CD59E2E33C38FA58998D4702D2B0C21666717A86945D18B3F29E5
Malicious:	false
Reputation:	unknown
Preview:	..........K.h.L...i.W...j.c...k.r...l.}...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....k.....}...........................................................!.....%.....M.....c...........................................................$.....5.....?.....E.....\.....p.....}.................................................................6.....N.....p.................................................................?.....F.....X.........................................K.....U.....`.....l.....................................................%.....,...../.....0.....=.....D.....I.....P.....W.....c.............................6.....N.....c.................................................................L.....e................................................... .!...".1...%.U...(.o...*.....+.....,.........../.....0.....1. ...3.6...4.L...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.&...@.A...A.q.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	987188
Entropy (8bit):	4.090571010189695
Encrypted:	false
SSDEEP:	3072:S3YCY5ynH4ASpuCkCxSiP84Gb/v5nB7zztROcA2P:SnVUdQO84Gb/v55zztROcA2P
MD5:	18EC8FF3C0701A6A8C48F341D368BAB5
SHA1:	8BFF8AEE26B990CF739A29F83EFDF883817E59D8
SHA-256:	052BCDB64A80E504BB6552B97881526795B64E0AB7EE5FC031F3EDF87160DEE9
SHA-512:	A0E997FC9D316277DE3F4773388835C287AB1A35770C01E376FB7428FF87683A425F6A6A605D38DD7904CA39C50998CD85F855CB33AE6ABAD47AC85A1584FE4E
Malicious:	false
Reputation:	unknown
Preview:	..........x.h.....i.....j.....k.....l.)...n.1...o.6...p.C...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...........................................................................................).....G.....P.......................M...........................................................,.....{.................&.....p.............................5.....W...........L.....d.......................#.....&.....8.....p.......................y...........+.....M.....Y.....a.....h.......................0.....K.....s.......................?...........$.....{.......................6.....w.....z.................1.....d...............................................1.....D...........c...........................................................$.....K.....c.....o.................S...........0.................U.....j........................... . ...".Z...%.....(.)...*.....+.....,.........../.....0.....1.....3.....4.7...5.....6.Z...7.....8.....9.$...;.g...<.....=.....>.....?.....@.0...A.y...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	916416
Entropy (8bit):	4.338166638560127
Encrypted:	false
SSDEEP:	12288:iy/yX8OsABW3p1F9SviTlwJAg5NFO1Tr/p54JAQvfEC28+58XoX0DTq9OyU+0Ak1:vu8OkDY5YMZb
MD5:	A17F16D7A038B0FA3A87D7B1B8095766
SHA1:	B2F845E52B32C513E6565248F91901AB6874E117
SHA-256:	D39716633228A5872630522306F89AF8585F8092779892087C3F1230D21A489E
SHA-512:	371FB44B20B8ABA00C4D6F17701FA4303181AD628F60C7B4218E33BE7026F118F619D66D679BFFCB0213C48700FAFD36B2E704499A362F715F63EA9A75D719E7
Malicious:	false
Reputation:	unknown
Preview:	..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|...........3.....g.............................@.....U...........4.....6.....B.....j.......................2.......................>.....`...........$.....U.....s...............................................,.....o.............................>.................<.................p.........................................8.......................M.....~.........................................P.....l.............................2.....T.........................................0.....W.....~.............................7.............................c.................7.....C.....s.......................T...........A.................p.......................C............... .....".....%.K...(.....*.....+.....,.......I.../.....0.....1.U...3.x...4.....5.....6.....7.....8."...9.V...;.....<.....=.....>.....?.....@.=...A...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	771431
Entropy (8bit):	4.388714549432334
Encrypted:	false
SSDEEP:	12288:5ZY31Mkgs3s5UvfZLRflsjj8FCG1LDoAGkEeuLAD57Kle9d8nyj9FR3o09XAyFHa:57yU5K54
MD5:	A32BA63FEEED9B91F6D6800B51E5AEAE
SHA1:	2FBF6783996E8315A4FB94B7D859564350EE5918
SHA-256:	E32E37CA0AB30F1816FE6DF37E3168E1022F1D3737C94F5472AB6600D97A45F6
SHA-512:	ADEBDE0F929820D8368096A9C30961BA7B33815B0F124CA56CA05767BA6D081ADF964088CB2B9FCAA07F756B946FFFA701F0B64B07D457C99FD2B498CBD1E8A5
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.....j.....k.....l.....o.....p.'...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................2.....V.............................\.....z...................................E.....r.............................&.....M.............................;.....V.....h.................1.............................+.....L.....X.....[.....j.......................2.....e...............................................&.....E.....~.................&.....Y.....t.................O.............................0.....3.....W.....x.........................................".....C.....U.....h.......................3.....E.................D.............................".....=.....d.......................e.................H....................................... .7...".L...%.....(.........+.-...,.>.....n.../.....0.....1.>...3.l...4.....5.....6.{...7.....8.....9.....;.....<.3...=.X...>.....?.....@.....A.-...C.r...D.....E...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	395016
Entropy (8bit):	5.625100269002306
Encrypted:	false
SSDEEP:	6144:xxl+G2KPlJi+kKD80GlTgAI7WTge95j/0+Vi1havX9vwiBrVmI:rlt2IlrRn57m5j/1
MD5:	5FF2E5C95067A339E3D6B8985156EC1F
SHA1:	7525B25C7B07F54B63B6459A0D8C8C720BD8A398
SHA-256:	14A131BA318274CF10DE533A19776DB288F08A294CF7E564B7769FD41C7F2582
SHA-512:	2414386DF8D7AB75DCBD6CA2B9AE62BA8E953DDB8CD8661A9F984EB5E573637740C7A79050B2B303AF3D5B1D4D1BB21DC658283638718FDD04FC6E5891949D1B
Malicious:	false
Reputation:	unknown
Preview:	..........".h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................#.....1.....O.....\.....p.........................................................../.....9.....R.....\|...........................................................J.....b.....f.....n.....{.................................................................H.....V.....[.....c.....j.....q.............................................../.....>.....u.................................................................-.....F.....V.....].....`.....a.....k.....t.....{.............................$.....c.....i.........................................(.....2.....;.....B.....[.....{.............................@.....V.....].....c.....r............... .....".....%.....(.....*.....+.....,.......E.../.^...0.g...1.....3.....4.....5.....6.....7.:...8._...9.t...;.....<.....=.....>.....?.....@.....A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	673547
Entropy (8bit):	4.9167574403691825
Encrypted:	false
SSDEEP:	12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
MD5:	361A0E1F665B9082A457D36209B92A25
SHA1:	3C89E1B70B51820BB6BAA64365C64DA6A9898E2F
SHA-256:	BD02966F6C6258B66EAE7FF014710925E53FE26E8254D7DB4E9147266025CC3A
SHA-512:	D4D25FC58053F8CCE4C073846706DC1ECBC0DC19308BA35501E19676F3E7ED855D7B57AE22A5637F81CEFC1AA032BF8770D0737DF1924F3504813349387C08CF
Malicious:	false
Reputation:	unknown
Preview:	........g...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}.........................................................................'.....D.....].........................................J...............................................6.....J.....a...................................O.....[.....m.............................C.....M.....].....t...............................................L.....}.........................................=.....d...................................+.....b.....y.............................1.....Q.....}...................................3.....c.....j.....m.....n.....~.............................I...........U.....g...........1.....`............................>.....R.....`.......................C.....x................./.....A.....U..................... .....".....%.0...(.j........+.....,.........../.J...0.\...1.....3.....4.....5.A...6.....7.....8.....9.....;.....<.%...=.9...>.....?.....@.....A.3...C.m...D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\ur.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	585532
Entropy (8bit):	5.197200392190567
Encrypted:	false
SSDEEP:	12288:UA3OsGF8Pz0WEJytlkA+7Z5QzUExbW7DQQYrhu6co/9NjjFpvJK:UAe3A85oWB
MD5:	1CA4FA13BD0089D65DA7CD2376FEB4C6
SHA1:	B1BA777E635D78D1E98E43E82D0F7A3DD7E97F9C
SHA-256:	3941364D0278E2C4D686FAA4A135D16A457B4BC98C5A08E62AA12F3ADC09AA7F
SHA-512:	D0D9EB1AA029BD4C34953EE5F4B60C09CF1D4F0B21C061DB4EDE1B5EC65D7A07FC2F780ADE5CE51F2F781D272AC32257B95EEDF471F7295BA70B5BA51DB6C51D
Malicious:	false
Reputation:	unknown
Preview:	..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....4.........................................?.....K.....U.........................................3.....H.....g...................................B.....n........................................._.....................................................1.....\.....~.......................G.....k.....z...............................................<...................................\.....................................................:.....U.....s...........................................................$.................b.....w.......................9.....U.....q.....w...................................<.......................?....._.....k........................... .....".....%.0...(.R...*.....+.....,.........../.....0.....1.K...3.e...4.....5.....6.....7.L...8.....9.....;.....<.....=.....>.....?.....@.!...A.Q...C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	466098
Entropy (8bit):	5.819101554769623
Encrypted:	false
SSDEEP:	12288:3CwEs5kAfnzs0ACmwSxXwzIJWl+58Qagi7+URTJziV53f:3qOFfnzs0AHwSGz5A5rri7+UtliV53f
MD5:	DB0EB3183007DE5AAE10F934FFFACC59
SHA1:	E9EA7AEFFE2B3F5CF75AB78630DA342C6F8B7FD9
SHA-256:	DDABB225B671B989789E9C2CCD1B5A8F22141A7D9364D4E6EE9B8648305E7897
SHA-512:	703EFD12FCACE8172C873006161712DE1919572C58D98B11DE7834C5628444229F5143D231C41DA5B9CF729E32DE58DEE3603CB3D18C6CDD94AA9AA36FBF5DE0
Malicious:	false
Reputation:	unknown
Preview:	........_...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.!...t....v.?...w.L...y.R...z.a...\|.g...}.y.........................................................................................%.....2.....;.....b.....n.....x.........................................%...../.....F.....f.....q...............................................!.....2.....D.....T.....{.................................................................+.....V.....t...........................................................:.....D.....c...................................F.....................................................#.....A.....Q.....i.................................................................E.....z.............................4.....?.....O.....Z.....e.....x.............................<.....T.....z............................................. ."...".;...%.a...(..........+.....,.........../.....0.....1.G...3.T...4.p...5.....6.....7.....8.....9.....;.+...<.5...=.F...>.a...?.m...@.....A.....C...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	340874
Entropy (8bit):	6.70707570391969
Encrypted:	false
SSDEEP:	6144:fmLpS8IeOL27M807pnCKjEWkE0G5xNlEPeVplD:fmLQmK2I1nCKjEjG5xNlEPe
MD5:	82326E465E3015C64CA1DB77DC6A56BC
SHA1:	E8ABE12A8DD2CC741B9637FA8F0E646043BBFE3D
SHA-256:	6655FD9DCDFAF2ABF814FFB6C524D67495AED4D923A69924C65ABEAB30BC74FB
SHA-512:	4989789C0B2439666DDA4C4F959DFFC0DDCB77595B1F817C13A95ED97619C270151597160320B3F2327A7DAFFC8B521B68878F9E5E5FB3870EB0C43619060407
Malicious:	false
Reputation:	unknown
Preview:	........,...h.J...i.R...j.U...k.d...l.k...m.s...o.y...p.~...r.....s.....t.....v.....w.....\|.....}.......................................................%.....'.....,.....Z.....c.....o.......................................................................C.....[.....a.....m.................................................................!.....9.....E.....i.....x.....~.................................................................2.....J.....b.....n.....t.....\|...........................................................%.....=.....^......................................................................./.....C.....R.....Y.....\.....^.....s.....\|.........................................>.....D.......................................................................(.....@.....j.....\|...............................................%... .+...".7...%.R...(.g...*.\|...+.....,.........../.....0.....1.....3. ...4.5...5.V...6.....7.....8.....9.....;.....<.....=.....>.,...?.<...@.T...A.....C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	338121
Entropy (8bit):	6.721086394879431
Encrypted:	false
SSDEEP:	6144:zQmZEIQee2hZuwv+2440f5lHz8wMCM/9ylTN:cvIpn+2440f5lHzgT/C
MD5:	2456BF42275F15E016689DA166DF9008
SHA1:	70F7DE47E585DFEA3F5597B5BBA1F436510DECD7
SHA-256:	ADF8DF051B55507E5A79FA47AE88C7F38707D02DFAC0CC4A3A7E8E17B58C6479
SHA-512:	7E622AFA15C70785AAF7C19604D281EFE0984F621D6599058C97C19D3C0379B2EE2E03B3A7EC597040A4EEE250A782D7EC55C335274DD7DB7C7CA97DDCFD378A
Malicious:	false
Reputation:	unknown
Preview:	............h.....i.+...j./...k.>...l.I...n.Q...o.V...p.^...r.d...s.u...t.~...v.....w.....y.....z.....\|.....}.............................................................>.....G.....S.....b.....h.....................................................!.....0.....H.....N.....Z.....i.....r.....~.................................................................2.....D.....J.....S....._.....k.....q.....w.....}.......................................................................).....5.....B.....W.....c.....o.........................................&...../.....;.....G.....Y.....t.....w...............................................................................................[.........................................?.....K.....W.....].....i.....o.....u.........................................E.....T.....Z.....`.....l............... .....".....%.....(.....*.....+.....,.......C.../.[...0.d...1.....3.....4.....5.....6.....7.%...8.7...9.C...;.U...<.e...=.u...>.....?.....@.....A.....C.....D...

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources.pak

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	5430320
Entropy (8bit):	7.995406820581218
Encrypted:	true
SSDEEP:	98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
MD5:	7971A016AED2FB453C87EB1B8E3F5EB2
SHA1:	92B91E352BE8209FADCF081134334DEA147E23B8
SHA-256:	9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
SHA-512:	42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
Malicious:	false
Reputation:	unknown
Preview:	............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<....<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g\|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..Opm..+O.x..,O(\|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	33320957
Entropy (8bit):	6.361797611132365
Encrypted:	false
SSDEEP:	196608:0K0V3rXjcovQ07qq+EDu2g1G5psKI4ne1Jpgjrnqd3cCUeo88H88D888HjtkEyBz:ErXoovhW/EDBeKIYeZ+ud+
MD5:	6D513BC85BE867C001A77D1DC2913952
SHA1:	BF910AABE8A750C0B34AED134E27ACBCC65A35F5
SHA-256:	147B789ED9537EE80A7F73199DEFFEAC3F0546B6DC6722A92D8AB812C67F1247
SHA-512:	6AF7FAF800B6D5077C3E4D5182C245E6C0D79A22414C90A2A11CE09EAAB4119219B600F13CBFFF09A7E598CA196A1305AE99D3CC4FAC321222EB8A486A8508D2
Malicious:	false
Reputation:	unknown
Preview:	....P...L...H...{"files":{"196b109f79670e11.js":{"size":2279873,"integrity":{"algorithm":"SHA256","hash":"1f74cfb89a99c40fc17fa85ba2f1db584e64dabd5ae85fc228cf60857741a2f5","blockSize":4194304,"blocks":["1f74cfb89a99c40fc17fa85ba2f1db584e64dabd5ae85fc228cf60857741a2f5"]},"offset":"0"},"package.json":{"size":576,"integrity":{"algorithm":"SHA256","hash":"bd12377370f62b5bf16e03766b69ac68c21c799713dd71c5ef612e45a1393693","blockSize":4194304,"blocks":["bd12377370f62b5bf16e03766b69ac68c21c799713dd71c5ef612e45a1393693"]},"offset":"2279873"},"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"7988439"},"index.mjs":{"size":299,"integrity":{"algorithm":"SHA256","hash":"b75d22297e1bd8992f86218f1749435d05921d2d765697e46a43f680b2edc859","blockSize":4

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	162352
Entropy (8bit):	4.860588090157433
Encrypted:	false
SSDEEP:	1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
MD5:	8FEF5A96DBCC46887C3FF392CBDB1B48
SHA1:	ED592D75222B7828B7B7AAB97B83516F60772351
SHA-256:	4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
SHA-512:	E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
Malicious:	false
Reputation:	unknown
Preview:	.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	476792
Entropy (8bit):	5.595608653079527
Encrypted:	false
SSDEEP:	3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
MD5:	A373D83D4C43BA957693AD57172A251B
SHA1:	8E0FDB714DF2F4CB058BEB46C06AA78F77E5FF86
SHA-256:	43B58CA4057CF75063D3B4A8E67AA9780D9A81D3A21F13C64B498BE8B3BA6E0C
SHA-512:	07FBD84DC3E0EC1536CCB54D5799D5ED61B962251ECE0D48E18B20B0FC9DD92DE06E93957F3EFC7D9BED88DB7794FE4F2BEC1E9B081825E41C6AC3B4F41EAB18
Malicious:	false
Reputation:	unknown
Preview:	.........K..11.0.226.20-electron.0..............................................`....f..8...........h...a........a........aT.......ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5209088
Entropy (8bit):	6.329767466271418
Encrypted:	false
SSDEEP:	49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
MD5:	A0845E0774702DA9550222AB1B4FDED7
SHA1:	65D5BD6C64090F0774FD0A4C9B215A868B48E19B
SHA-256:	6150A413EBE00F92F38737BDCCF493D19921EF6329FCD48E53DE9DBDE4780810
SHA-512:	4BE0CB1E3C942A1695BAE7B45D21C5F70E407132ECC65EFB5B085A50CDAB3C33C26E90BD7C86198EC40FB2B18D026474B6C649776A3CA2CA5BFF6F922DE2319B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......?..........&8...................................... Q...........`A........................................X.J.~.....J.P.....P.......N..c............P..}....J.....................h.J.(...@.?.8...........x.K.P............................text...".?.......?................. ..`.rdata..$.....?.. ....?.............@..@.data...`.....K.......K.............@....pdata...c....N..d...\M.............@..@.00cfg..(.....P.......N.............@..@.gxfg...`,... P.......N.............@..@.retplne\....PP.......N..................tls....Q....`P.......N.............@....voltbl.8....pP.......N................._RDATA........P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}....P..~....N.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\7z-out\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920576
Entropy (8bit):	6.556557427650666
Encrypted:	false
SSDEEP:	24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
MD5:	0E4E0F481B261EA59F196E5076025F77
SHA1:	C73C1F33B5B42E9D67D819226DB69E60D2262D7B
SHA-256:	F681844896C084D2140AC210A974D8DB099138FE75EDB4DF80E233D4B287196A
SHA-512:	E6127D778EC73ACBEB182D42E5CF36C8DA76448FBDAB49971DE88EC4EB13CE63140A2A83FC3A1B116E41F87508FF546C0D7C042B8F4CDD9E07963801F3156BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." .....l................................................................`A............................................<!..T...P...............pn..............<...Tn......................8m..(...@...8............................................text....k.......l.................. ..`.rdata..4............p..............@..@.data....L...P... ...6..............@....pdata..pn.......p...V..............@..@.00cfg..(...........................@..@.gxfg... (... ...*..................@..@.retplne\....P...........................tls.........`......................@....voltbl.8....p.........................._RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\SpiderBanner.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.5347224014600345
Encrypted:	false
SSDEEP:	192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5:	17309E33B596BA3A5693B4D3E85CF8D7
SHA1:	7D361836CF53DF42021C7F2B148AEC9458818C01
SHA-256:	996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
SHA-512:	1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	79260688
Entropy (8bit):	7.999994745298454
Encrypted:	true
SSDEEP:	1572864:B4opqebwv/Ubzv9xFJgHaXOTqPLk8rDbDkkagQkpIEtrI+4IH751iPZR:BHlbq/UHzFJsNH8nkkagQfWrRd11UZR
MD5:	88AEA4DA9E9BA9EF087412E76CFAE3F4
SHA1:	C16733FE7A49CAD6EAEDAE4E1B56D386AA68347E
SHA-256:	28782E4DE27281363B792C9141DC094F09A20B7249DC52A54BBF95D10C468273
SHA-512:	2E7537C41B9F38709776A5959E6209C7D7B13F81644E7640AEE4582D980AFC68C73F08F55CC125C40B71ECC2D9D188728754B0BAF2B77B83BF1B6C96271D6162
Malicious:	false
Reputation:	unknown
Preview:	7z..'.....F..k......%........m.......]...6...#k.![y.`.Gr#.f..F.....c}.R\|..j=...,._..z..gC5Q.j...7S.:0`..o..^.._e....0.....K....T).XS.CPP'....B...&...<..f........`".U01o...QI.3i.].vD.d9...V...>%.+..5...~M.,.[.....q..1..../.&.h...4;!<..-O......4r......8..a.\I....=...!NNs.QB.."..M?....J..D...bvy....u#.:,..y..5T^.&'% !"....-...u<kJ..;..9..X6....v..b...T.9u..#.v.(l....n.......v...ZE.i...uEcGJ!c+.;...Z.n.:.0...-...!..$...^l-`A%kX<..,.....2...........^....a...L...s.x..RN.w..]@;~ymo:J.....i..M......h..Z.nL...........J}J.. .l...O...[5.>.5........;....o..up..1.N4H9.K..es....l.(.-W=(z.OR.\|r .k.......\.?}.ua..L.~..'K).&...iIAoe...u.. ...Z.f../8P.....H._.!........@_.S..m.*F....g....-....i.:&i..h.n..6&..H.}..!.T...e....S.........$.....Sazv...[.W9+.A..}P^.p........uFh..\o...Ft...$.p..-.....:).......g\...&>.^.<..!8N.@mmC....?.Q.(.]t....8.i.........!fh..dd....)...eL.L`.a..Z1hD.$.j..[Fz..I..b.C.\|...._\.w$..5.rB.+....B..&!....i..J..8..7..u..x.h...?......!p.

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:	96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xvqbjcbdhoq4.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.3248014991837365
Encrypted:	false
SSDEEP:	3:vhjPM8tl/as4K5jPM8tl/9lojm9PM8tl/3EWVArn3tU8tl/XXvK4KV3tU8tl/9li:5jHgS5jHi0HO0WxR/cVxSmIc4WSB8lC
MD5:	70D3351A284D68DF9156FB6B43AF63F2
SHA1:	D94FE64C3F4A89D7E0079C40CC138516D6295772
SHA-256:	50963C4E5CB89DA96A642CD002FA1CB4A71382646ED96B50F2584E1FD810AC7F
SHA-512:	659E79DA802ED1918263BBF9EB50C9981A102563E3225A1C9B9B0E949B8C0C34E356B77823B4BCFD2AF472EED2792BE7C260505E275E8AA1A0EB4BD7262CFC0E
Malicious:	false
Reputation:	unknown
Preview:	PK...........Y................Autofill/PK...........Y................Cookies/PK...........Y................Passwords/PK.............Y.........................A....Autofill/PK.............Y.........................A'...Cookies/PK.............Y.........................AM...Passwords/PK..............u.....

C:\Users\user\AppData\Roaming\All_Wallets.zip

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	22
Entropy (8bit):	1.0476747992754052
Encrypted:	false
SSDEEP:	3:pjt/l:Nt
MD5:	76CDB2BAD9582D23C1F6F4D868218D6C
SHA1:	B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
SHA-256:	8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
SHA-512:	5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
Malicious:	false
Reputation:	unknown
Preview:	PK....................

C:\Users\user\AppData\Roaming\unrealgame\5c9b78fb-578f-4fe5-9f07-36bff3624a57.tmp

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.650986727154189
Encrypted:	false
SSDEEP:	12:YKWSg99rrt+yeVJRSrninkDJrp5Qm8dII3:YKWfrrtR4JvkX5QxdII3
MD5:	7D6D64DE81FDBDEBD7BF3C16DF6A2692
SHA1:	2B8CB6C1615755610CCF01F8F7C78E3E0DADDCE2
SHA-256:	F8BB1001AE635209DFBE5A5EC79336246C85A1BECD988E2EBD711FF007D65752
SHA-512:	6C87B781DCE6C4180A00DA3915467DB87157E599F6A2B954769446D215C649EC68962F9C0C776C677B187F2E2D8D8C56066568E9F5EB002C8F418F479EADF7FF
Malicious:	false
Reputation:	unknown
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaAAAAAAIAAAAAABBmAAAAAQAAIAAAAJ3Og4IM87n3YD1xB4zDXmaLpFae3HuvtJGdGL3FQ6geAAAAAA6AAAAAAgAAIAAAAB5lJ3lga31/TA79phOa/76rwNrHrz2viLYLtsqUBH79MAAAAHVS0kHzmOqBLSMiouhSPi40fGQ6bUAsctQP/Cf488uibonzsYHevx3xKCkRLSH9iEAAAACJxxencF58kzuMFnwkGjrWRTCNr7azt25KsJN19t+KOmHa1chc9sDDlnhFlzSxMEaj1w5PJ5mO61C+mv9iJo9s"}}

C:\Users\user\AppData\Roaming\unrealgame\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.650986727154189
Encrypted:	false
SSDEEP:	12:YKWSg99rrt+yeVJRSrninkDJrp5Qm8dII3:YKWfrrtR4JvkX5QxdII3
MD5:	7D6D64DE81FDBDEBD7BF3C16DF6A2692
SHA1:	2B8CB6C1615755610CCF01F8F7C78E3E0DADDCE2
SHA-256:	F8BB1001AE635209DFBE5A5EC79336246C85A1BECD988E2EBD711FF007D65752
SHA-512:	6C87B781DCE6C4180A00DA3915467DB87157E599F6A2B954769446D215C649EC68962F9C0C776C677B187F2E2D8D8C56066568E9F5EB002C8F418F479EADF7FF
Malicious:	false
Reputation:	unknown
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADacuojRefESJioRTg6FSjaAAAAAAIAAAAAABBmAAAAAQAAIAAAAJ3Og4IM87n3YD1xB4zDXmaLpFae3HuvtJGdGL3FQ6geAAAAAA6AAAAAAgAAIAAAAB5lJ3lga31/TA79phOa/76rwNrHrz2viLYLtsqUBH79MAAAAHVS0kHzmOqBLSMiouhSPi40fGQ6bUAsctQP/Cf488uibonzsYHevx3xKCkRLSH9iEAAAACJxxencF58kzuMFnwkGjrWRTCNr7azt25KsJN19t+KOmHa1chc9sDDlnhFlzSxMEaj1w5PJ5mO61C+mv9iJo9s"}}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2391519016385746
Encrypted:	false
SSDEEP:	48:FaqdF79/0+AAHdKoqKFxcxkF3/waqdF7w+AAHdKoqKFxcxkFQ:cEi+AAsoJjykzEw+AAsoJjykm
MD5:	FEE3E6293C13A3EBFE5464BABD011F3E
SHA1:	CD519FAD8862EB20DDC739FCDA4D5D591D24978D
SHA-256:	FCA6BDC826DEEE57E92CF202581E006D51DD05657CC136E57D8D5B12A1D6D93E
SHA-512:	A844263F464F8161F7030418A1524B62BCE0A00A8CE99455C06A6BB38E416BEBC98E233D3AE03AA070E7CF21701B90B6939DE25F2037333CC3DCC857D484C798
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. O.c.t. .. 0.4. .. 2.0.2.3. .1.2.:.0.3.:.4.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999980549853268
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Kameta Setup 1.0.0.exe
File size:	79'764'652 bytes
MD5:	0157b710ec82b63db471a4030979fbd3
SHA1:	03e1e97522f61193836a6f2b489699ba5b087b5e
SHA256:	4bcd67e69705a2aed00ecfb30e2e9f05af8a0e00d5cb787e8427d100f766ca54
SHA512:	64007bef4f0f44c6b46bb858f18a330b7e9c2fcc042cbf240d37290b5b128ed17c539b3b1b78c2852499c55ac4dcd151d9fd1ed0bb55aacd2bef7c2359664f8d
SSDEEP:	1572864:c44opqebwv/Ubzv9xFJgHaXOTqPLk8rDbDkkagQkpIEtrI+4IH751iPZG:c4Hlbq/UHzFJsNH8nkkagQfWrRd11UZG
TLSH:	A90833D0887D9412E8841D7E9EA54BFC969A37356FF3D88AC041BD7CEEB301D071986A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	0771ccf8d84d2907

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007FD76CF5F9C3h
push ebx
call 00007FD76CF62C75h
cmp eax, ebx
je 00007FD76CF5F9B9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FD76CF62BEFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FD76CF5F99Ch
push 0000000Ah
call 00007FD76CF62C48h
push 00000008h
call 00007FD76CF62C41h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007FD76CF62C35h
cmp eax, ebx
je 00007FD76CF5F9C1h
push 0000001Eh
call eax
test eax, eax
je 00007FD76CF5F9B9h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x5968	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x5968	0x5a00	de31c045e84038aea7ef34bb9bc488a1	False	0.4951388888888889	data	5.453547846840774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f5c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x1a0670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x1a1518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x1a1dc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x1a2328	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x1a2790	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x1a2a78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x1a2ba0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a2da8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a2ea0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a2f90	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a3190	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a3280	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a3368	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a3558	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a3640	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a3720	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a3910	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a39f8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a3ad8	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a3cd0	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a3db8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a3e98	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a40a0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a4198	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a4288	0x68	data	English	United States	0.6634615384615384
RT_VERSION	0x1a42f0	0x250	data	English	United States	0.4847972972972973
RT_MANIFEST	0x1a4540	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 06:32:29.690854073 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:29.690900087 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:29.691051006 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:30.083044052 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:30.083066940 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.493860006 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.494327068 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.494340897 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.495310068 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.495433092 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.497293949 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.497330904 CET	443	49737	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.497419119 CET	49737	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.507261038 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.507298946 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:31.507499933 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.508222103 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:31.508239985 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.177160978 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.177615881 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.177639961 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.178699970 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.178766012 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.179554939 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.179591894 CET	443	49740	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.179645061 CET	49740	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.182020903 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.182058096 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:33.182146072 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.182539940 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:33.182555914 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.549777985 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.550405025 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:34.550427914 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.551321030 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.551429033 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:34.553951979 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:34.553982019 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.554109097 CET	443	49741	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:34.554177999 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:34.554177999 CET	49741	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:34.736145020 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:34.736188889 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:34.736665964 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:34.737035036 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:34.737050056 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:36.215146065 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:36.215859890 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:36.215886116 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:36.216882944 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:36.216955900 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:36.218126059 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:36.218163013 CET	443	49743	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:36.218204021 CET	49743	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:36.454720020 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:36.454762936 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:36.454855919 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:36.455327034 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:36.455339909 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:37.673675060 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:37.674305916 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:37.674321890 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:37.675347090 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:37.675415039 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:37.676512957 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:37.676558971 CET	443	49745	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:37.676670074 CET	49745	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:37.682280064 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:37.682313919 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:37.682383060 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:37.683012962 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:37.683027983 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:39.096446991 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:39.097795010 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:39.097811937 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:39.098819017 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:39.098880053 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:39.099883080 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:39.099940062 CET	443	49746	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:39.100025892 CET	49746	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:42.735843897 CET	49748	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.735872984 CET	443	49748	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.735924006 CET	49748	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736049891 CET	49749	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736071110 CET	443	49749	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.736124992 CET	49749	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736248970 CET	49750	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736257076 CET	443	49750	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.736331940 CET	49750	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736418962 CET	49751	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.736426115 CET	443	49751	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.736465931 CET	49751	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.737623930 CET	49751	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.737633944 CET	443	49751	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.737759113 CET	49750	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.737773895 CET	443	49750	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.737867117 CET	49749	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.737878084 CET	443	49749	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:42.737971067 CET	49748	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:42.737979889 CET	443	49748	172.217.21.36	192.168.2.4
Dec 4, 2024 06:32:43.174354076 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.174386024 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:43.174489975 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.175818920 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.175836086 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:43.272628069 CET	49748	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:43.272905111 CET	49750	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:43.272936106 CET	49749	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:43.272969961 CET	49751	443	192.168.2.4	172.217.21.36
Dec 4, 2024 06:32:43.959418058 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.959455013 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:43.959639072 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.960155010 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:43.960181952 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.482964993 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.483429909 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:44.483453035 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.484518051 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.484793901 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:44.490288973 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:44.490288973 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:44.490355015 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.556443930 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:44.556452990 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:44.752873898 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.002291918 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.002341986 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.002419949 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.042781115 CET	49754	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.042800903 CET	443	49754	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.262536049 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.450750113 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.530914068 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.530932903 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.532124043 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.532138109 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:45.532191992 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.852365971 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:45.852523088 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:46.042618036 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:46.042632103 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:32:46.151020050 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:32:48.080456018 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:48.080502033 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:48.080562115 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:48.080889940 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:48.080904007 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.456854105 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.460165024 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:49.460211992 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.461173058 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.461255074 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:49.468357086 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:49.468394995 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.468486071 CET	443	49768	45.112.123.126	192.168.2.4
Dec 4, 2024 06:32:49.468553066 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:49.468569994 CET	49768	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:32:49.490087986 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:49.490101099 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:49.493478060 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:49.493959904 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:49.493968964 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:50.757080078 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:50.757559061 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:50.757565975 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:50.758445024 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:50.758503914 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:50.759402990 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:50.759429932 CET	443	49770	143.244.215.221	192.168.2.4
Dec 4, 2024 06:32:50.759484053 CET	49770	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:32:50.761917114 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:50.761944056 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:50.762161016 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:50.762542963 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:50.762553930 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.175825119 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.180565119 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.180581093 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.181946993 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.182005882 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.188966990 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.188996077 CET	443	49772	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.189054966 CET	49772	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.461117029 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.461146116 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:52.461215019 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.461945057 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:52.461957932 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.877245903 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.877789974 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:53.877811909 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.878902912 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.878973961 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:53.879936934 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:53.880037069 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.880162001 CET	443	49773	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:53.880219936 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:53.880238056 CET	49773	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:54.903021097 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:54.903049946 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:54.903110027 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:54.903719902 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:54.903731108 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.265763998 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.266243935 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:56.266257048 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.267240047 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.267311096 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:56.268027067 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:56.268057108 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.268158913 CET	443	49775	38.172.200.46	192.168.2.4
Dec 4, 2024 06:32:56.268212080 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:32:56.268223047 CET	49775	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:00.048917055 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:33:00.048990011 CET	443	49756	172.64.41.3	192.168.2.4
Dec 4, 2024 06:33:00.049289942 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:33:02.824156046 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:02.824201107 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:02.824387074 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:02.824599981 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:02.824615955 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:04.251822948 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:04.252265930 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:04.252289057 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:04.253161907 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:04.253212929 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:04.254065990 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:04.254102945 CET	443	49779	45.112.123.126	192.168.2.4
Dec 4, 2024 06:33:04.254154921 CET	49779	443	192.168.2.4	45.112.123.126
Dec 4, 2024 06:33:04.257566929 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:04.257611036 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:04.257671118 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:04.258224964 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:04.258239031 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.570184946 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.570679903 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:05.570699930 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.571585894 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.571770906 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:05.572364092 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:05.572408915 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.572503090 CET	443	49782	143.244.215.221	192.168.2.4
Dec 4, 2024 06:33:05.572567940 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:05.572567940 CET	49782	443	192.168.2.4	143.244.215.221
Dec 4, 2024 06:33:05.574246883 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:05.574260950 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:05.574410915 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:05.574892998 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:05.574903011 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.989557981 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.990267038 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:06.990273952 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.991117001 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.991168976 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:06.991897106 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:06.991921902 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.992013931 CET	443	49788	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:06.992130041 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:06.992141962 CET	49788	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:07.063146114 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:07.063180923 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:07.063361883 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:07.064197063 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:07.064212084 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:08.470902920 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:08.471216917 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:08.471240044 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:08.472225904 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:08.472280979 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:08.473057032 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:08.473088980 CET	443	49789	38.172.200.46	192.168.2.4
Dec 4, 2024 06:33:08.473170996 CET	49789	443	192.168.2.4	38.172.200.46
Dec 4, 2024 06:33:45.051151037 CET	49756	443	192.168.2.4	172.64.41.3
Dec 4, 2024 06:33:45.051163912 CET	443	49756	172.64.41.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 06:32:34.586838961 CET	52322	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:34.730398893 CET	53	52322	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:36.223651886 CET	58432	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:36.453670025 CET	53	58432	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:42.581361055 CET	61509	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:42.581614017 CET	54420	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:42.695678949 CET	53	59015	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:42.720551014 CET	53	61509	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:42.721481085 CET	53	54420	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:42.723119020 CET	53	51079	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:43.032665014 CET	59608	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:43.032957077 CET	50919	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:43.172142029 CET	53	59608	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:43.172985077 CET	53	50919	1.1.1.1	192.168.2.4
Dec 4, 2024 06:32:45.838525057 CET	56638	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:45.838673115 CET	55015	53	192.168.2.4	1.1.1.1
Dec 4, 2024 06:32:45.980318069 CET	53	55015	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 06:32:34.586838961 CET	192.168.2.4	1.1.1.1	0x41b9	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:36.223651886 CET	192.168.2.4	1.1.1.1	0x24c5	Standard query (0)	file.io	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:42.581361055 CET	192.168.2.4	1.1.1.1	0xdd35	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:42.581614017 CET	192.168.2.4	1.1.1.1	0x2584	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 4, 2024 06:32:43.032665014 CET	192.168.2.4	1.1.1.1	0x39c2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:43.032957077 CET	192.168.2.4	1.1.1.1	0xd074	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 4, 2024 06:32:45.838525057 CET	192.168.2.4	1.1.1.1	0x603f	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:45.838673115 CET	192.168.2.4	1.1.1.1	0x38e	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 06:32:34.730398893 CET	1.1.1.1	192.168.2.4	0x41b9	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:36.453670025 CET	1.1.1.1	192.168.2.4	0x24c5	No error (0)	file.io		143.244.215.221	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:42.720551014 CET	1.1.1.1	192.168.2.4	0xdd35	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:42.721481085 CET	1.1.1.1	192.168.2.4	0x2584	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 4, 2024 06:32:43.172142029 CET	1.1.1.1	192.168.2.4	0x39c2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:43.172142029 CET	1.1.1.1	192.168.2.4	0x39c2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 4, 2024 06:32:43.172985077 CET	1.1.1.1	192.168.2.4	0xd074	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 4, 2024 06:32:45.980040073 CET	1.1.1.1	192.168.2.4	0x603f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 06:32:45.980318069 CET	1.1.1.1	192.168.2.4	0x38e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49754	172.64.41.3	443	8836	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 05:32:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-04 05:32:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-04 05:32:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Dec 2024 05:32:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ec96aec3b73429d-EWR alt-svc: h3=":443"; ma=86400
2024-12-04 05:32:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Target ID:	0
Start time:	00:32:02
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\Kameta Setup 1.0.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Kameta Setup 1.0.0.exe"
Imagebase:	0x400000
File size:	79'764'652 bytes
MD5 hash:	0157B710EC82B63DB471A4030979FBD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:32:03
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq KametaSetup.exe" \| %SYSTEMROOT%\System32\find.exe "KametaSetup.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:32:03
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:32:03
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq KametaSetup.exe"
Imagebase:	0x410000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:32:03
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\find.exe "KametaSetup.exe"
Imagebase:	0x730000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:32:24
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe"
Imagebase:	0x7ff75c4a0000
File size:	162'028'032 bytes
MD5 hash:	7153F5DCF75B41969A641F98F370D035
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:32:26
Start date:	04/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff68f8f0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:32:26
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic bios get smbiosbiosversion
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM chrome.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:32:28
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM centbrowser.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM 7star.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM msedge.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM kometa.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM opera.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM firefox.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM brave.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM uran.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff75c4a0000
File size:	162'028'032 bytes
MD5 hash:	7153F5DCF75B41969A641F98F370D035
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM orbitum.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM epicprivacybrowser.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	00:32:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM iridium.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM vivaldi.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM sputnik.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM yandex.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7640, Parent PID: 7520

General

Target ID:	69
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq msedge.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	00:32:30
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq chrome.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	00:32:31
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq iexplore.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	00:32:31
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq firefox.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	00:32:31
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq iexplore.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	00:32:33
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	00:32:33
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	00:32:33
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic MemoryChip get /format:list
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	00:32:33
Start date:	04/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Speed"
Imagebase:	0x7ff6ed9c0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	00:32:34
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	00:32:34
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:32:34
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	00:32:35
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	00:32:35
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	00:32:36
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\unrealgame\KametaSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1208 --field-trial-handle=2188,i,5456543408629399747,16697329975367127579,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Imagebase:	0x7ff75c4a0000
File size:	162'028'032 bytes
MD5 hash:	7153F5DCF75B41969A641F98F370D035
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	85
Start time:	00:32:35
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8952, Parent PID: 8944

General

Target ID:	87
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic bios get smbiosbiosversion
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9088, Parent PID: 9080

General

Target ID:	90
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic MemoryChip get /format:list
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Speed"
Imagebase:	0x7ff6ed9c0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	00:32:37
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9184, Parent PID: 9176

General

Target ID:	94
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1804, Parent PID: 1620

General

Target ID:	99
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8168, Parent PID: 1620

General

Target ID:	100
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM brave.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5472, Parent PID: 8168

General

Target ID:	103
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM firefox.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7900, Parent PID: 4088

General

Target ID:	105
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM opera.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM kometa.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8108, Parent PID: 1620

General

Target ID:	109
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM orbitum.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1312, Parent PID: 1620

General

Target ID:	110
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM centbrowser.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6960, Parent PID: 6640

General

Target ID:	111
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	00:32:38
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM 7star.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM firefox.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM sputnik.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7440, Parent PID: 6640

General

Target ID:	118
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM opera.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM msedge.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM brave.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM chrome.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM vivaldi.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8124, Parent PID: 2764

General

Target ID:	124
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM epicprivacybrowser.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7676, Parent PID: 1620

General

Target ID:	127
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM uran.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7608, Parent PID: 7848

General

Target ID:	128
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM yandex.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7932, Parent PID: 1620

General

Target ID:	130
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM iridium.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7696, Parent PID: 7676

General

Target ID:	131
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	132
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	134
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq msedge.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7444, Parent PID: 1620

General

Target ID:	135
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7984, Parent PID: 7252

General

Target ID:	136
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	137
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq iexplore.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7888, Parent PID: 7444

General

Target ID:	138
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	139
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7288, Parent PID: 7356

General

Target ID:	140
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	141
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	142
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq chrome.exe""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7632, Parent PID: 8108

General

Target ID:	143
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM orbitum.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	144
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM kometa.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	145
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM centbrowser.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	146
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	147
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM 7star.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	148
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM sputnik.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	149
Start time:	00:32:39
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM vivaldi.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	150
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM epicprivacybrowser.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	151
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM yandex.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	152
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM uran.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	153
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM iridium.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	154
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: tasklist.exePID: 8428, Parent PID: 7356

General

Target ID:	155
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq iexplore.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	156
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq chrome.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	157
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq firefox.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	158
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq msedge.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	159
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	160
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq iexplore.exe"
Imagebase:	0x7ff75ecf0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	161
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	162
Start time:	00:32:40
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic bios get smbiosbiosversion
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	163
Start time:	00:32:41
Start date:	04/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2052 --field-trial-handle=2012,i,14256643865995858684,9263389117564715630,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	164
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7628, Parent PID: 1620

General

Target ID:	165
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7820, Parent PID: 7332

General

Target ID:	166
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	167
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	168
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic MemoryChip get /format:list
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	169
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM chrome.exe /F
Imagebase:	0x7ff751070000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	170
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Speed"
Imagebase:	0x7ff6ed9c0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	171
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6640, Parent PID: 7900

General

Target ID:	172
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	173
Start time:	00:32:42
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	174
Start time:	00:32:43
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7264, Parent PID: 7476

General

Target ID:	175
Start time:	00:32:43
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	176
Start time:	00:32:43
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: msedge.exePID: 4340, Parent PID: 1620

General

Target ID:	177
Start time:	00:32:43
Start date:	04/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	178
Start time:	00:32:44
Start date:	04/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2072 --field-trial-handle=1972,i,2766285570963821738,1807897661508393279,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	179
Start time:	00:32:46
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7560, Parent PID: 7952

General

Target ID:	180
Start time:	00:32:46
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	182
Start time:	00:32:46
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic bios get smbiosbiosversion
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	183
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list \| find /i "Speed""
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7944, Parent PID: 7256

General

Target ID:	184
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	185
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic MemoryChip get /format:list
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	186
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Speed"
Imagebase:	0x7ff6ed9c0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	187
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7996, Parent PID: 8112

General

Target ID:	188
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	189
Start time:	00:32:47
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff602c90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	190
Start time:	00:32:48
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7992, Parent PID: 1804

General

Target ID:	191
Start time:	00:32:48
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	192
Start time:	00:32:48
Start date:	04/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: dllhost.exePID: 8976, Parent PID: 752

General

Target ID:	193
Start time:	00:32:48
Start date:	04/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	194
Start time:	00:32:49
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
Imagebase:	0x7ff628160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8500, Parent PID: 8248

General

Target ID:	195
Start time:	00:32:49
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	200
Start time:	00:32:49
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	216
Start time:	00:32:50
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	227
Start time:	00:32:50
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	232
Start time:	00:32:50
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	251
Start time:	00:32:51
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	252
Start time:	00:32:52
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	256
Start time:	00:32:52
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	263
Start time:	00:32:52
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	273
Start time:	00:32:53
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	278
Start time:	00:32:53
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	284
Start time:	00:32:53
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	299
Start time:	00:32:54
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	304
Start time:	00:32:54
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	315
Start time:	00:32:55
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	336
Start time:	00:32:55
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	366
Start time:	00:32:57
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	377
Start time:	00:32:57
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	382
Start time:	00:32:57
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	403
Start time:	00:32:58
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	413
Start time:	00:32:59
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	418
Start time:	00:32:59
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	434
Start time:	00:32:59
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	444
Start time:	00:33:01
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	450
Start time:	00:33:01
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	455
Start time:	00:33:01
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	460
Start time:	00:33:02
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	471
Start time:	00:33:02
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	476
Start time:	00:33:02
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	481
Start time:	00:33:02
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	486
Start time:	00:33:03
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	492
Start time:	00:33:03
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cef0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	497
Start time:	00:33:03
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	502
Start time:	00:33:03
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	507
Start time:	00:33:04
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	539
Start time:	00:33:05
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	544
Start time:	00:33:05
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	549
Start time:	00:33:05
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	555
Start time:	00:33:06
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	570
Start time:	00:33:06
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	576
Start time:	00:33:06
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	586
Start time:	00:33:07
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	591
Start time:	00:33:07
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	597
Start time:	00:33:07
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	612
Start time:	00:33:08
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	623
Start time:	00:33:09
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	639
Start time:	00:33:09
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	644
Start time:	00:33:10
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	649
Start time:	00:33:10
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	654
Start time:	00:33:10
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	665
Start time:	00:33:11
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	681
Start time:	00:33:12
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	686
Start time:	00:33:12
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	696
Start time:	00:33:12
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6eef20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	702
Start time:	00:33:13
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	707
Start time:	00:33:13
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	717
Start time:	00:33:13
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	728
Start time:	00:33:14
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	733
Start time:	00:33:15
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	749
Start time:	00:33:15
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	770
Start time:	00:33:16
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	775
Start time:	00:33:17
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	780
Start time:	00:33:17
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	786
Start time:	00:33:17
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	791
Start time:	00:33:17
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	796
Start time:	00:33:18
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	807
Start time:	00:33:18
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	833
Start time:	00:33:19
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	838
Start time:	00:33:20
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	854
Start time:	00:33:20
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	864
Start time:	00:33:21
Start date:	04/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	27%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.2%
Total number of Nodes:	1333
Total number of Limit Nodes:	35

Executed Functions

Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
NSIS Error, xrefs: 00403451
TMP, xrefs: 0040361F
.tmp, xrefs: 0040374B
\Temp, xrefs: 004035E9
TEMP, xrefs: 00403617
~nsu, xrefs: 0040372F
Error launching installer, xrefs: 004036BA
SeShutdownPrivilege, xrefs: 00403859
Low, xrefs: 00403605

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-3195845224
Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNELBASE(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(?,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58

Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004DF000,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(00460250,\*.*,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNELBASE(00460250,?,?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
Opcode Fuzzy Hash: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E

Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
FindClose.KERNELBASE(00000000), ref: 00406614

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,00450248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E

Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,74DF3420,004CB000,00000000), ref: 00403A2B
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00472E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
RegisterClassW.USER32(00472E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

RichEd20, xrefs: 00403BD8
RichEd32, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403A16
.exe, xrefs: 00403AB8
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
RichEdit, xrefs: 00403C05
RichEdit20W, xrefs: 00403BF6, 00403BFC
_Nb, xrefs: 00403B2E, 00403B96
Remove folder: , xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-564491471
Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E

Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0042CE00,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0042CE00,Remove folder: ), ref: 0040647A
CoTaskMemFree.OLE32(0042CE00), ref: 00406485
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000), ref: 00406503

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5
Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\, xrefs: 00406301
Remove folder: , xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1796724754
Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E

Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Error launching installer, xrefs: 00402F2D
soft, xrefs: 00402FCB
Inst, xrefs: 00402FC2
Null, xrefs: 00402FD4

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
Opcode Fuzzy Hash: 6fdf7a3c576b274adc95fc68e3ac1b8cc101307f87f608dfe476064d1f7918cb
Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

ExecShellAsUser, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp$C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll$ExecShellAsUser
API String ID: 1941528284-2358903507
Opcode ID: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
Opcode Fuzzy Hash: 84cc1ef8d08a74648e49299eefb5f22073aa957ae4a4092afed5da839c45f715
Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

UXTHEME, xrefs: 0040662D
\, xrefs: 0040664C
%s%S.dll, xrefs: 00406670

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp
API String ID: 2655323295-1148382729
Opcode ID: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
Opcode Fuzzy Hash: 1af8095f3c9504d2ce798825688ccba5ec512a5a8ae6ba4a7bc3247cfd6f00f3
Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29

Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

lstrlenW.KERNEL32(00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405CF0
GetFileAttributesW.KERNELBASE(00464250,00464250,00464250,00464250,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00405D00

Strings

PBF, xrefs: 00405C9D

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: PBF
API String ID: 3248276644-3456974464
Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(0069D2C0), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

ExecShellAsUser, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Global$AllocFree
String ID: ExecShellAsUser
API String ID: 3394109436-869331269
Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D

Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614

lstrlenW.KERNEL32 ref: 00402299
lstrlenW.KERNEL32(00000000), ref: 004022A4
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59

Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C

Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405405

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405451

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,004DF000,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14

Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09

Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19

Function 004038D0 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E

Non-executed Functions

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

N, xrefs: 00404F29
M, xrefs: 00404E48
, xrefs: 00405257

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58

Function 00404722 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

A, xrefs: 00404845
Remove folder: , xrefs: 00404883, 00404888, 00404893

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Remove folder:
API String ID: 2624150263-1936035403
Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 004072EC Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 004043F0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

gC@, xrefs: 004045FA
Remove folder: , xrefs: 004045CD
N, xrefs: 0040458C

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder: $gC@
API String ID: 3103080414-3559505530
Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

[Rename], xrefs: 00405FEF, 00406001
%ls=%ls, xrefs: 00405F7B

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\, xrefs: 00405343, 00405353, 00405359, 0040537C, 00405388

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\
API String ID: 2531174081-1759447992
Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E

Strings

MS Shell Dlg, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(04C11CA8,00000064,04C11CAC), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
Opcode Fuzzy Hash: ff87bf99e36aab27b6384dee017154e4bdeff7ac382f3b09721b2446f84e6f42
Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98

Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nszB3DC.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp$C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\StdUtils.dll
API String ID: 3109718747-800205506
Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nszB3DC.tmp\), ref: 004061D9

Strings

Remove folder: , xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.1923285885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1923258695.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923308746.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000483000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923333659.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1923607015.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Kameta Setup 1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kameta Setup 1.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\26d157fd-2ca2-4c01-b057-d93229d09364.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50c15ad4-c3c9-4922-9f5f-356837788599.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\611a4120-f6b2-46a7-bbe5-d3a05ebc0f5f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674FE97B-10F4.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\68ac5585-ab26-4d82-b0ef-61a83891f1c7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Windows Analysis Report
Kameta Setup 1.0.0.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre