Edit tour

Windows Analysis Report
0442.pdf.exe

Overview

General Information

Sample name:	0442.pdf.exe renamed because original name is a hash value
Original sample name:	.pdf.exe
Analysis ID:	1580649
MD5:	4f6b2b9ee57c50d6c505d0cdada4803e
SHA1:	ad7dee6f1f71c4fe6299170a160592f139390e12
SHA256:	62410e8399acf7834c74012783bde3fe9ff244e048141c4a96a65bec06895f37
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Enables network access during safeboot for specific services

Enables remote desktop connection

Initial sample is a PE file and has a suspicious name

Uses an obfuscated file name to hide its real file extension (double extension)

Uses ping.exe to check the status of other devices and networks

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0442.pdf.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\0442.pdf.exe" MD5: 4F6B2B9EE57C50D6C505D0CDADA4803E)

msiexec.exe (PID: 7400 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

cmd.exe (PID: 7416 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7712 cmdline: ping 8.8.8.8 MD5: 2F46799D79D22AC72C241EC0322B011D)

Acrobat.exe (PID: 7436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1720,i,4460427527233058691,5362964774260238234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

Acrobat.exe (PID: 7528 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

msiexec.exe (PID: 7480 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

ROMFUSClient.exe (PID: 8276 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8324 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8552 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8600 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8640 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8732 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start MD5: F3D74B072B9697CF64B0B8445FDC8128)

svchost.exe (PID: 7976 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ROMServer.exe (PID: 8764 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8916 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8928 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
12.0.ROMServer.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
11.0.ROMFUSClient.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0442.pdf.exe", CommandLine: "C:\Users\user\Desktop\0442.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\0442.pdf.exe, NewProcessName: C:\Users\user\Desktop\0442.pdf.exe, OriginalFileName: C:\Users\user\Desktop\0442.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\0442.pdf.exe", ProcessId: 7312, ProcessName: 0442.pdf.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7976, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0442.pdf.exe	Virustotal: Detection: 44%			Perma Link
Source: 0442.pdf.exe	ReversingLabs: Detection: 26%

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: 0442.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0442.pdf.exe

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64150B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF64150B190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6414F40BC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64151FCA0 FindFirstFileExA,	0_2_00007FF64151FCA0

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 101.99.91.150 ports 5651,8080,1,5,6,80

Enables network access during safeboot for specific services

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry value created: NULL Service

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8

Source: global traffic

TCP traffic: 192.168.2.4:49796 -> 101.99.91.150:5651

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000009.00000002.3428915948.000001B231800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ROMFUSClient.exe, 0000000B.00000000.1807368103.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1824434137.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000012.00000002.3580742486.000000000158C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000278C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000288C000.00000004.00001000.00020000.00000000.sdmp, MSI6694.tmp.5.dr	String found in binary or memory: http://litemanager.com/
Source: ROMFUSClient.exe, 00000015.00000002.3580857023.0000000002893000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03
Source: ROMServer.exe, 00000012.00000002.3580742486.0000000001593000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03Y
Source: ROMServer.exe, 00000012.00000002.3580742486.000000000158C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000288C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/1
Source: ROMFUSClient.exe, 0000000B.00000000.1807368103.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1824434137.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Russian.lg.5.dr	String found in binary or memory: http://litemanager.ru/
Source: ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://litemanager.ru/noip.txtU
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: MSI6694.tmp.5.dr	String found in binary or memory: http://www.LiteManagerTeam.com
Source: ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMFUSClient.exe, 0000000B.00000003.1831206649.0000000002A07000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000C.00000003.1827685942.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe, 0000000E.00000003.1849439942.00000000029F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000F.00000003.1843162771.0000000002B37000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000003.1887504046.0000000002877000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.1884190514.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.3580742486.00000000014F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3580707479.0000000002827000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.00000000027F7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000009.00000003.1746773700.000001B231AA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://litemanager.com/romversion.txt
Source: ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://litemanager.com/soft/pro/ROMServer.zip
Source: svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000009.00000003.1746773700.000001B231A56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 0442.pdf.exe

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6414EC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6414EC2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\675fde.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6694.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\675fe1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\675fe1.msi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\675fe1.msi

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64150B190	0_2_00007FF64150B190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641503484	0_2_00007FF641503484
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FA4AC	0_2_00007FF6414FA4AC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414EF930	0_2_00007FF6414EF930
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F4928	0_2_00007FF6414F4928
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641510754	0_2_00007FF641510754
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64150CE88	0_2_00007FF64150CE88
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641501F20	0_2_00007FF641501F20
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414E5E24	0_2_00007FF6414E5E24
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414E7288	0_2_00007FF6414E7288
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F126C	0_2_00007FF6414F126C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414EA310	0_2_00007FF6414EA310
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414EC2F0	0_2_00007FF6414EC2F0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FF180	0_2_00007FF6414FF180
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6415021D0	0_2_00007FF6415021D0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FB534	0_2_00007FF6414FB534
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6415053F0	0_2_00007FF6415053F0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414E76C0	0_2_00007FF6414E76C0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641522550	0_2_00007FF641522550
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414E4840	0_2_00007FF6414E4840
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64151C838	0_2_00007FF64151C838
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641502AB0	0_2_00007FF641502AB0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414E1AA4	0_2_00007FF6414E1AA4
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64151FA94	0_2_00007FF64151FA94
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F1A48	0_2_00007FF6414F1A48
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641525AF8	0_2_00007FF641525AF8
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6415189A0	0_2_00007FF6415189A0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FC96C	0_2_00007FF6414FC96C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641503964	0_2_00007FF641503964
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FBB90	0_2_00007FF6414FBB90
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641504B98	0_2_00007FF641504B98
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F5B60	0_2_00007FF6414F5B60
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641518C1C	0_2_00007FF641518C1C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414FAF18	0_2_00007FF6414FAF18
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641502D58	0_2_00007FF641502D58
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641508DF4	0_2_00007FF641508DF4
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641510754	0_2_00007FF641510754
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641522080	0_2_00007FF641522080

Source: ROMViewer.exe.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe0.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: ROMServer.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMFUSClient.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMServer.exe0.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMViewer.exe.5.dr	Static PE information: Number of sections : 11 > 10

Source: ROMViewer.exe.5.dr

Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfmEditBinaryValue'

Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A452000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1719082545.000001FD263F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeX vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000002.1724730932.000001FD263F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1722421395.000001FD263F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A3CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A46C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe

Source: classification engine

Classification label: mal88.troj.evad.winEXE@46/95@1/3

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6414EB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6414EB6D8

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF641508624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF641508624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSLocal
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSTray
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Users\user\Desktop\0442.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6773328

Jump to behavior

Source: Yara match	File source: 12.0.ROMServer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.ROMFUSClient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, type: DROPPED

Source: C:\Users\user\Desktop\0442.pdf.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "

Source: 0442.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\0442.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0442.pdf.exe	Virustotal: Detection: 44%
Source: 0442.pdf.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\0442.pdf.exe

File read: C:\Users\user\Desktop\0442.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0442.pdf.exe "C:\Users\user\Desktop\0442.pdf.exe"
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1720,i,4460427527233058691,5362964774260238234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1720,i,4460427527233058691,5362964774260238234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray

Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll

Source: C:\Users\user\Desktop\0442.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Start LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Uninstall LiteManager - Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Windows\SysWOW64\msiexec.exe
Source: Stop LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Settings for LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0442.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0442.pdf.exe

Static file information: File size 11409543 > 1048576

Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0442.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0442.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0442.pdf.exe

Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0442.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6773328

Jump to behavior

Source: 0442.pdf.exe	Static PE information: section name: .didat
Source: 0442.pdf.exe	Static PE information: section name: _RDATA
Source: ROMViewer.exe.5.dr	Static PE information: section name: .didata
Source: ROMFUSClient.exe.5.dr	Static PE information: section name: .didata
Source: ROMwln.dll.5.dr	Static PE information: section name: .didata
Source: ROMServer.exe.5.dr	Static PE information: section name: .didata
Source: HookDrv.dll.5.dr	Static PE information: section name: .didata
Source: ROMServer.exe0.5.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641525156 push rsi; retf		0_2_00007FF641525157
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641525166 push rsi; retf		0_2_00007FF641525167

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\romserver.exe

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (132).png

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 0442.pdf.exe

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\LiteManager\v3.4\Server\Parameters NoIPSettings

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 8064	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8488	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8236	Thread sleep count: 58 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 9004	Thread sleep time: -156500s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64150B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF64150B190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6414F40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6414F40BC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF64151FCA0 FindFirstFileExA,	0_2_00007FF64151FCA0

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6415116A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6415116A4

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: ROMFUSClient.exe, 0000000B.00000002.1833475633.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3429021282.000001B23185D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3427620774.000001B22C22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ROMFUSClient.exe, 0000000B.00000002.1833475633.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ROMServer.exe, 00000012.00000002.3579999575.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3579966201.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580071969.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF641513170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF641513170

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF641520D20 GetProcessHeap,

0_2_00007FF641520D20

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641513170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF641513170
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641512510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF641512510
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF641513354 SetUnhandledExceptionFilter,	0_2_00007FF641513354
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF6415176D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6415176D8

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF64150B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF64150B190

Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6415258E0 cpuid

0_2_00007FF6415258E0

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF64150A2CC

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF641510754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF641510754

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6414F51A4 GetVersionExW,

0_2_00007FF6414F51A4

Remote Access Functionality

Enables remote desktop connection

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server AllowRemoteRPC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Windows Service	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	222 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0442.pdf.exe	44%	Virustotal		Browse
0442.pdf.exe	26%	ReversingLabs	Win64.Trojan.Uztuby

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	8%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	3%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://litemanager.ru/	0%	Avira URL Cloud	safe
http://www.LiteManagerTeam.com	0%	Avira URL Cloud	safe
https://litemanager.com/romversion.txt	0%	Avira URL Cloud	safe
http://litemanager.com/03	0%	Avira URL Cloud	safe
https://litemanager.com/soft/pro/ROMServer.zip	0%	Avira URL Cloud	safe
http://litemanager.com/1	0%	Avira URL Cloud	safe
http://litemanager.ru/noip.txtU	0%	Avira URL Cloud	safe
http://litemanager.com/03Y	0%	Avira URL Cloud	safe
http://litemanager.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://litemanager.com/1	ROMServer.exe, 00000012.00000002.3580742486.000000000158C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000288C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://litemanager.ru/	ROMFUSClient.exe, 0000000B.00000000.1807368103.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1824434137.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Russian.lg.5.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000009.00000003.1746773700.000001B231A56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://litemanager.com/soft/pro/ROMServer.zip	ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://litemanager.com/03	ROMFUSClient.exe, 00000015.00000002.3580857023.0000000002893000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://litemanager.com/romversion.txt	ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	false		high
http://ocsp.thawte.com0	0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	false		high
http://litemanager.ru/noip.txtU	ROMServer.exe, 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3428915948.000001B231800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1746773700.000001B231AA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://litemanager.com/	ROMFUSClient.exe, 0000000B.00000000.1807368103.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.1824434137.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000012.00000002.3580742486.000000000158C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000278C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.000000000288C000.00000004.00001000.00020000.00000000.sdmp, MSI6694.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://www.LiteManagerTeam.com	MSI6694.tmp.5.dr	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	ROMFUSClient.exe, 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMFUSClient.exe, 0000000B.00000003.1831206649.0000000002A07000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000C.00000003.1827685942.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000C.00000000.1812231802.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMFUSClient.exe, 0000000E.00000003.1849439942.00000000029F7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000F.00000003.1843162771.0000000002B37000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000003.1887504046.0000000002877000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.1884190514.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.3580742486.00000000014F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3580707479.0000000002827000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3580857023.00000000027F7000.00000004.00001000.00020000.00000000.sdmp	false		high
http://litemanager.com/03Y	ROMServer.exe, 00000012.00000002.3580742486.0000000001593000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A408000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1715364678.000001FD2A446000.00000004.00000020.00020000.00000000.sdmp, 675fde.msi.5.dr, ms.msi.0.dr	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000009.00000003.1746773700.000001B231AC2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
101.99.91.150	unknown	Malaysia		45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580649
Start date and time:	2024-12-25 15:16:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0442.pdf.exe renamed because original name is a hash value
Original Sample Name:	.pdf.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@46/95@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.19.126.149, 2.19.126.143, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 184.28.90.27, 23.195.39.65, 2.22.50.131, 2.22.50.144, 88.221.168.141, 18.213.11.84, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	yvaKqhmD4L.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	#U5b89#U88c5#U7a0b#U5e8f_1.1.1.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	IoIB9gQ6OQ.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	eCompleted_419z.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	3FG4bsfkEwmxFYY.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	#U5b89#U88c5#U52a9#U624b1.0.3.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	eCompleted_419z.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Onboard Training Checklist v1.1 - Wyatt Young (1).xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	94e.exe	Get hash	malicious	Remcos	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	94e.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	94e.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	0442.pdf.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	101.99.92.189
	http://www.recorderkorea.com/shop/proc/indb.cart.tab.php?action=ok&tab=today&type=delete&returnUrl=https://23058.hicleanly.ca/uoeujd/shuhsdy/odog/kratos/REDIRECT/Zl2jyY/compliance@yourmom.com	Get hash	malicious	Unknown	Browse	101.99.81.34
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	101.99.75.174
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	101.99.75.174
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	101.99.75.174
	Scan_03774843.pdf	Get hash	malicious	Unknown	Browse	101.99.77.51

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\675fe0.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	23984
Entropy (8bit):	5.167530144913046
Encrypted:	false
SSDEEP:	192:kmC7js8t8t+CqZ+6ySyDy6ylNbywyYylygy2fhWBiBNMBiBNvBiBNq5yoio2YUgs:kH75t8t+CqZ+cNbynfhzOj3IXygyVOVi
MD5:	2CCC85B6A0BE7513E3622B79D6A5AC1A
SHA1:	E7A22D7D8A67D5E163806FEBA4390E907C9A6DA5
SHA-256:	89B41C016BF9B834415BD7AE07E89CA8E62F07A774AB01063B0CC8D3536DC762
SHA-512:	B6A13E2CCFA0D7C51691668B35C6077AA1CA96D4404CBDAADDF7F01557F3DFA04DDCAD8FC702FD9F989800A31498C3F4162C69C3AC943B3376F06C8DFB4AF45C
Malicious:	false
Preview:	...@IXOS.@.....@;J.Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..ms.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3244CDE6-6414-4399-B0D5-424562747210}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{A3DC5A2F-2249-4674-BE

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132032
Entropy (8bit):	6.10195829980833
Encrypted:	false
SSDEEP:	3072:sh/1J7RYdzZU4Z5tegH1q888888888888W888888888882zgP:sh/jIZPZ5tJ8888888888888W888888s
MD5:	C40455A478E0B76521130D9DAAAADC4B
SHA1:	42DE923D5E36A9F56B002DD66DB245BC44480089
SHA-256:	308085BC357BF3A3BEE0D662FCC01628E9EE2FFD478AE0F1E7140939AD99B892
SHA-512:	76ED6D763F603BCAA7FE186C0A7449E614DCDB18036F7587C6E5A11C3F3269E400E3D2062856CC280AC20C094617924783B6C360F25AF66767DCC53C2F3045C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: gBYz86HSwI.msi, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....xK............................p........ ..........................................................................\.......\...............................x#...................................................................................text...$........................... ..`.itext.............................. ..`.data...0.... ......................@....bss....xN...@...........................idata..\...........................@....edata..\............&..............@..@.reloc..x#.......$...(..............@..B.rsrc................L..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default language ID 1049
Category:	dropped
Size (bytes):	58679
Entropy (8bit):	4.738446173390891
Encrypted:	false
SSDEEP:	768:bkJC7UF9eVWSlBY8Aq9CBGDtD8gX1ZDCZjewbAsCw1vPDQuJPQzusxxeCNHnPPsT:htwqueMZYU
MD5:	BAED4E7AF33F77350D454B69317EE63B
SHA1:	2B598774F0C73850A36117F29EA8DAC57BE1C138
SHA-256:	671D65183C39E53FC1759C45B105A0FBE2D3A216E4099B66D5FCF274EA625E07
SHA-512:	E740997BDECB8F907A000D01BF3E823898A1289D1DBFAE5BF342D4BCB6FF09D258317955F4FD858FF6B239E5BA08E49E90CDEC06E24DABDB18C1CF2D8943590C
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1251\uc1\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049{\fonttbl{\f0\froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f211\froman\fcharset0\fprq2 Times New Roman{\\falt Times New Roman};}..{\f209\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times New Roman};}{\f212\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times New Roman};}{\f213\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Times New Roman};}..{\f214\froman\fcharset177\fprq2 Times New Roman (Hebrew){\\falt Times New Roman};}{\f215\froman\fcharset178\fprq2 Time

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	89220
Entropy (8bit):	3.469297258214741
Encrypted:	false
SSDEEP:	768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
MD5:	B1C96EF24061BF294CAC6C4C9CBF7757
SHA1:	5D1B1934091E257B5F1C69B13F5FC1E424348584
SHA-256:	20DB884523DA62C20F80B8A3BB71E11091B90A443B83C06D8FE2A1BBC00C1C33
SHA-512:	6E90562FD804F91DDADEF2310551063D34B859FF1CC6E58A41667E9CDA062DCA851C8455882EF47CF3E1A8EC21EBD9F0761F15E54174CC4A95427238CB39BA14
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.3.3.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .Q.u.e.s.t.i.o.n.....e.r.r.o.r. .=. .E.r.r.o.r.....i.n.f.o.r.m.a.t.i.o.n. .=. .I.n.f.o.r.m.a.t.i.o.n.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .N.o.t.i.f.i.c.a.t.i.o.n.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .C.a.n. .n.o.t. .r.e.a.d. .s.e.r.v.i.c.e. .c.o.n.f.i.g.u.r.a.t.i.o.n...\.n.;.R.e.i.n.s.t.a.l.l. .L.i.t.e.M.a.n.a.g.e.r. .s.e.r.v.i.c.e.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e...\.n.;.R.e.b.o.o.t. .s.y.s.t.e.m.,. .p.l.e.a.s.e.......

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201728
Entropy (8bit):	6.3607488106285075
Encrypted:	false
SSDEEP:	3072:rmqdVRkbN1G3OKtVLqKc3IuQquARCASmShKJ:rmyTmNw3zqKcFLRs
MD5:	1D4F8CFC7BBF374CCC3AAE6045B2133D
SHA1:	802EDF0B0ED1D0305BCD6688EE3301366FEC1337
SHA-256:	C04885562F17BAEEFBCD2D4FC29F054EB8A66C44BD015750498C69A912D94C1F
SHA-512:	68643A30FEA87B2B61AF546F42BF32A25459152C1BCCE5A8A881714139CE828DFE4237874FF1E9CC3B78D6CDBEF7DD45C9F3459C3337D83693C704C274AFFF3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: gBYz86HSwI.msi, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|..[.................\...........v............@.................................................................. ...................@...................@...G..................................................$................................text....S.......T.................. ..`.itext..D....p.......X.............. ..`.data...<............`..............@....bss....<Y...............................idata...............z..............@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc...G...@...H..................@..B.rsrc....@.......@..................@..@....................................@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	61034
Entropy (8bit):	4.429529654892776
Encrypted:	false
SSDEEP:	768:nebbtdP4XFsh6HWiIZTYp7JtMLG54ttg2kGPyWtvQTznCKDMlV2f:ne3KOhTTocL8HnMlV2f
MD5:	7303B5AE0B8911CEB238DC01419695BE
SHA1:	22B89BDB8FAEC62BA3E66639E38E6271B593944A
SHA-256:	88155FB3F0E198AA4A24F9CFECBB83C5A4E081C6EA362BC50294410CB2FB5C50
SHA-512:	8AE802616AF60BAF214E254F6A55D312DC46B6E3F8BEE5F50E30E372FF38103776278B5FB07A562C2149EEA58107CB427A03B1629F72044AB69D3507E5DFAB15
Malicious:	false
Preview:	[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.2.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .OUL.....e.r.r.o.r. .=. ./.......i.n.f.o.r.m.a.t.i.o.n. .=. ........n.o.t.i.f.i.c.a.t.i.o.n. .=. ....w....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .!q.l...S.g.RD}Ka.0\.n.;...e.[. .L.i.t.e.M.a.n.a.g.e.r. ..g.R?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0\.n.;....e.._j.\|q}.0....f.m._.s.e.t.t.i.n.g.s._.r.e.s.t.a.r.t._.s.e.r.v.i.c.e._.t.o._.a.p.p.l.y. .=. ....e_U.R .L.M. .:O.ghV.a(u.z._.NWY(u...f.0....f.m._.s.e.c.u.r.i.t.y._.f.o.r.c.e._.g.u.e.s.t. .=. .7_6R.O.(Wdk.\|q}.N-..[.....asTW.@b.g.}..O(u.....S.g.O.X[.S.kP..0 .!q.l.O(u.07_

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	58794
Entropy (8bit):	3.642324420313977
Encrypted:	false
SSDEEP:	768:D+XPobz4qFlRiiXc0HwgHSSxnrKT7nke7GShFBy/x97fuTLY57aC7I/Fj:yPQMw1ZOT7kef1y/X7fuTq4j
MD5:	606DC375E898D7221CCB7CEB8F7C686B
SHA1:	26DCF93876C89283623B8150C1B79EDB24B6A7EC
SHA-256:	F442E440580EA35040E35BF1D85A118E7C182FDE0B9BA2A3C1816DEAB5F822BB
SHA-512:	9FBC42165B51A2020D2DA2FFE33287A4F3AA33639126813B290D329D47C4F4DA8F297A47AF3C1F63AF6F9E1BA47ACE840BC1660D603E17589E5DB6DDA0E1E5B1
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.5.5.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .S.o.r.u.....e.r.r.o.r. .=. .H.a.t.a.....i.n.f.o.r.m.a.t.i.o.n. .=. .B.i.l.g.i.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .B.i.l.d.i.r.i.m.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .H.i.z.m.e.t. .y.a.p.1.l.a.n.d.1.r.m.a.s.1. .o.k.u.n.a.m.1.y.o.r...\.n.;.L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t.i.n.i. .y.e.n.i.d.e.n. .y...k.l.e.m.e.k. .m.i. .i.s.t.i.y.o.r.s.u.n.u.z.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r...\.n.;.S.i.s.t.e.m.i. .y.e.n.i.d.e.n. .b.a._.l.

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (305), with CRLF line terminators
Category:	dropped
Size (bytes):	87912
Entropy (8bit):	4.303374267443204
Encrypted:	false
SSDEEP:	768:VUlHxa/yEOYEJNHWjlUu1pZ26ER2nkUTbfk74Q:aNxWREb4lUu1P29R2JbfC4Q
MD5:	3FC082E8F516EAD9FC26AC01E737F9EF
SHA1:	3B67EBCE4400DDCF6B228E5668F3008561FB8F21
SHA-256:	3DC0CEAE11F445B57B17B7C35A90B5133E313CF6B61550AB418252C5B8089C99
SHA-512:	9A9D20AF2F8C27056F58AB5A9C687F5124CE5F6D563E396C9558331FB8BE48E88E148B1FDC548A5EBDEDB451E3D89F2F96856F3BBFD695691D5687599F376421
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d. .=. .1.0.5.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...8.B.0.=.=.O.....e.r.r.o.r. .=. ...>.<.8.;.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.V.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...>.2.V.4.>.<.;.5.=.=.O.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.<.>.6.;.8.2.>. .?.@.>.G.8.B.0.B.8. .:.>.=.D.V.3.C.@.0.F.V.N. .A.;.C.6.1.8...\.n.;...5.@.5.2.A.B.0.=.>.2.8.B.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6307408
Entropy (8bit):	6.5944937257467116
Encrypted:	false
SSDEEP:	98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
MD5:	63D0964168B927D00064AA684E79A300
SHA1:	B4B9B0E3D92E8A3CBE0A95221B5512DED14EFB64
SHA-256:	33D1A34FEC88CE59BEB756F5A274FF451CAF171A755AAE12B047E678929E8023
SHA-512:	894D8A25E9DB3165E0DAAE521F36BBD6F9575D4F46A2597D13DEC8612705634EFEA636A3C4165BA1F7CA3CDC4DC7D4542D0EA9987DE10D2BC5A6ED9D6E05AECB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................C..F........C.......C...@.......................... i.......`..........@................... N.......M..A...@T...............`.P"...PN.<............................@N.......................M.......N......................text.....C.......C................. ..`.itext...0....C..2....C............. ..`.data... 3....C..4....C.............@....bss........0E..........................idata...A....M..B....E.............@....didata.......N......LE.............@....edata....... N......ZE.............@..@.tls....X....0N..........................rdata..]....@N......\E.............@..@.reloc..<....PN......^E.............@..B.rsrc........@T......DK.............@..@............. i.......`.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7753808
Entropy (8bit):	6.615075046955521
Encrypted:	false
SSDEEP:	98304:D4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCAFIqOx9N:DXQ7SIEXeMBk2V4N/Nq2Iqw9N
MD5:	F3D74B072B9697CF64B0B8445FDC8128
SHA1:	8408DA5AF9F257D12A8B8C93914614E9E725F54C
SHA-256:	70186F0710D1402371CE2E6194B03D8A153443CEA5DDB9FC57E7433CCE96AE02
SHA-512:	004054EF8CDB9E2FEFC3B7783574BFF57D6D5BF9A4624AD88CB7ECCAE29D4DFD2240A0DC60A14480E6722657132082332A3EC3A7C49D37437644A31E59F551AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w#.f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g.. ............v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.... ....g.. ....^.............@..@............. ........v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	999944
Entropy (8bit):	6.626732213066839
Encrypted:	false
SSDEEP:	12288:SA9+TVJdg0YMgqAahyv0jKdTq4lrBhqSq/rt8VwGFrt:SRho0lgqA6yvnrBhq/rQDt
MD5:	ED32E23322D816C3FE2FC3D05972689E
SHA1:	5EEA702C9F2AC0A1AADAE25B09E7983DA8C82344
SHA-256:	7F33398B98E225F56CD287060BEFF6773ABB92404AFC21436B0A20124919FE05
SHA-512:	E505265DD9D88B3199EB0D4B7D8B81B2F4577FABD4271B3C286366F3C1A58479B4DC40CCB8F0045C7CD08FD8BF198029345EEF9D2D2407306B73E5957AD59EDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...`.-\.................J...........X.......`....@.................................................................. ...................@...........0.......@.. O...................................................................................text...0?.......@.................. ..`.itext..8....P.......D.............. ..`.data....:...`...<...N..............@....bss.....]...............................idata..............................@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc.. O...@...P..................@..B.rsrc....@.......@..................@..@.....................0..............@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	94772
Entropy (8bit):	4.284840986247552
Encrypted:	false
SSDEEP:	768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
MD5:	0E204FABE68B4B65ED5E0834651FB732
SHA1:	B338A6E54AA18F3F8A573580520F16C74A51F3D2
SHA-256:	302373D81F0AE15589206420CB01A266804C9FD1C1FF0D6E09CE6BA3FEF92B64
SHA-512:	AAD76F6A76DC693D959389CE471BC585D0DA72737FED99F42F219FDC7C71617C00E8003A467092E12820A359D672C6FB80D99772F3F6433923B2ABB7EEA40F08
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.4.9.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...>.?.@.>.A.....e.r.r.o.r. .=. ...H.8.1.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.8.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...?.>.2.5.I.5.=.8.5.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.2.>.7.<.>.6.=.>. .?.@.>.G.8.B.0.B.L. .:.>.=.D.8.3.C.@.0.F.8.N. .A.;.C.6.1.K...\.n.;...5.@.5.C.A.B.0.=.>.2.8.B.L. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r...\.n.

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7752272
Entropy (8bit):	6.615186281886958
Encrypted:	false
SSDEEP:	98304:y4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOxJn:yXQ7SIEXeMBk2V4N/NqiIqwJn
MD5:	84FB34E529BEDE393A3F604EAA8137B2
SHA1:	195EA03B7BD086454A13C0D8357E0A9E447D9EC9
SHA-256:	1E396C4066AC8F421A54893442A0D76C4F8D4146E63825D67DFC0DA782E73EE5
SHA-512:	A48A80D62E588667B4C891CDED279BABFFA5FB4FDF092F345212F81D29A9ACAA06E6DB27B49DC601909409A3C82AA9272BCDF90D0AE1738E83E80D9FCA4D93E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g..............(v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.........g.......^.............@..@............. .......(v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11361360
Entropy (8bit):	6.496049600782297
Encrypted:	false
SSDEEP:	98304:AshiRp5hPI7N9sSA5wbZXJOu/0uOXZYfmQYanSjS+cWuNOlQpgfYLyPsd+QgBBP5:Al5hPwgvyAjDjS+igfgym+bHJxmK
MD5:	B0E355EC3453C8FFAEE08CD4257E96F2
SHA1:	0FA023CA8F1C1ECDADDE3DD3BD551870C2D965E2
SHA-256:	60248BA026064B116E4F94020DABB74DF519F5B4C41379CA19A38D725692CA8E
SHA-512:	B6004F83FD78EED84BF21611EFA45F2FFADF3625E0A2FDCDAE531B4734A4B886EBFE5EBE990DA42302B7368282D83DFFEF19E71DA8EC4C155EE5C8619AD028DD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................v..67.......v...... v...@..........................0...................@...................p...........L...p....+..........:..P"...................................................................`.......................text.....u.......u................. ..`.itext...6....u..8....u............. ..`.data....R... v..T....v.............@....bss.........w..........................idata...L.......N...Xw.............@....didata......`........w.............@....edata.......p........w.............@..@.tls....`................................rdata..].............w.............@..@.reloc................w.............@..B.rsrc.....+..p....+.................@..@.............0.......:..............@..@................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.310820402560299
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvry:KooCEYhgYEL0In
MD5:	ADCAF32CA884E5E02C87BB8192A16184
SHA1:	59A70788B171B9CF3F470CD3E8D84B8027406A33
SHA-256:	981395A4F0C37EB9BA2B6351D3F3FF0A7337AA0BBB818A559F028B44AF17F553
SHA-512:	FD8EF6154B14CAECC48943049DDDB5E595044A7733CBA4172596DF1572287FB1CBC0C412C0653D51033FD77FFF2F2336216AC21D0556F04A066F80BB3140B207
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x97f73736, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42223889778651835
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:nazag03A2UrzJDO
MD5:	712650B7F69FEEE3CD638AD2154D262B
SHA1:	38F439EE388E4C3A417B22EB8BADB8BB45C2E0D3
SHA-256:	E45E9ADA489F5FB34EF429EFB474EF13FE7C65430ADD89224749DD7A1EBFED52
SHA-512:	81E3D7A22CC2503C8198ADE173844F4DC07D6916E0023CA939B0DB39862AB3195EF5CA87FD878E1BCE828C16EBBDDCFB88DCBED7C479694A98BDA6B65528A67F
Malicious:	false
Preview:	..76... .......Y.......X\...;...{......................n.%..........\|..7....\|..h.#..........\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................)R.....\|..................n..d.....\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07942319433619086
Encrypted:	false
SSDEEP:	3:cO0llOetYelPpZovpZa/m4ZRG6JrUa/AYZ/illOE/tlnl+/rTc:cXrzlP3ovpZaVZk6GaoYZepMP
MD5:	86250EB98E33FFE6E25B65DC6FB36AF6
SHA1:	51B4238F7834608BD1A0C86EACB38DF7743CD3EE
SHA-256:	9B1C12443B7FF833CAF2908BE6A36386A0959574391A2E2E39A35F479EC0A545
SHA-512:	F6CB454E1EE6462030DA44B54B0E39E1317219D24F2E9879210E2D94E549F832A159F52876E049B13B233FB84EAB63B3C90FA2443086F03F005B3FBB6AF1AE4E
Malicious:	false
Preview:	........................................;...{..7....\|.......\|...............\|.......\|..i..I.....\|..................n..d.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 18:41:10 2024, mtime=Wed Dec 25 13:17:59 2024, atime=Thu Aug 22 18:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	3.9115109293741543
Encrypted:	false
SSDEEP:	48:882VndOOGZ7fZd5Y+d5YsP5qoZkmrSUp8JWqoZkmtw:88GG5a9O5qoZbcJWqoZbt
MD5:	D5F57D43923ED9F42FDBF946C1F108E8
SHA1:	6714D74A3375B2D4FC43CE74DE65FF06320C2742
SHA-256:	40609B814EE3D0DAB7E6F35B669E110DB0DB920F1083120A518B07F00B0C6BD9
SHA-512:	2208DD72E0B8A89A960A2C2AC9A247B3405496840E6E17C741C5B2CDF017AABB209DDC8F432BF742E746980F385119E0A158F4A1D2F8E784906783DF0259B114
Malicious:	false
Preview:	L..................F.@.. ......=....O....V.....=....PPv..........................P.O. .:i.....+00.../C:\.....................1......Y;r..PROGRA~2.........O.I.Y;r....................V.....C...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1......Y=r..LITEMA~1..b......Y;r.Y@r....J.........................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%..Y@r....;.........................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k............\|.z.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.c.o.n.f.i.g.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	3.1573107695942624
Encrypted:	false
SSDEEP:	48:8ddOEPLqd5Y+d5YcCP5q2DT2S0Wq2DTKX7:85LJ9cM5qUoWqUE
MD5:	5FC67E19699B3F0B2AB7B4B89B0B3F1A
SHA1:	6F6380DF2EB8C5D30452A846864F001A8B0E473A
SHA-256:	45451F933B472FA53301D46B7C072AF67E51EC60172E6E9C01E0B308DF78A2F4
SHA-512:	81C7A9F5683DB54893BD26A6EC1BCBDB17983037668CD996E03934E7708331594195DBF2CCE9EB2B0C0567A9E8B24DD629D40866D49E55C9DF77A864D15744E5
Malicious:	false
Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)..."...1...........LiteManager Pro - Server..b............................................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r...(.h.2...........ROMServer.exe.L............................................R.O.M.S.e.r.v.e.r...e.x.e.......L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.a.r.t.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.R.O.M.S.e.r.v.e.r...e.x.e._.9.D.0.9.B.2.B.C.2.5.A.2.4.1.4.C.B.D.8.4.8.E.2.B.7.5.8.9.8.6.7.6...e.x.e.........%SystemRoot%\In

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 18:41:10 2024, mtime=Wed Dec 25 13:17:58 2024, atime=Thu Aug 22 18:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	3.8929359019311023
Encrypted:	false
SSDEEP:	48:8W2VndOOyqZE7fZd5Y+d5Ys5qcxFWT84SslWqcxFWT8cw:8WGyqZka9s5qcxYT8SWqcxYT8c
MD5:	EF1B278A3E909BA6FDF538EADF1E7CE6
SHA1:	C5588303D5E3E663B22D0BD20981833BB5CB5856
SHA-256:	2EE27F024225839D35AB6C3A941582D7D39C6484D0719D34515F9525CE91FADB
SHA-512:	C39E47A4C07182201EA18271AFA1A8E270BB59BC8B032DB108C8B74624DCF050563EE27ADB0A79241C6EDFF2B8077C0BDC4BCAF4E383240C776E67CE25D526D2
Malicious:	false
Preview:	L..................F.@.. ......=....~...V.....=....PPv..........................P.O. .:i.....+00.../C:\.....................1......Y;r..PROGRA~2.........O.I.Y;r....................V.....C...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1......Y=r..LITEMA~1..b......Y;r.Y=r....J.......................y.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%..Y=r....;.........................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k............\|.z.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.o.p.l.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.s.t

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Oct 4 09:56:56 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	3.8717779563455585
Encrypted:	false
SSDEEP:	24:8WnJvqw/nbTABPwB+sHyjv/+MTyjvejIKZDUHwGS7ke4WTyjvejIKZDUHwwcfSyu:8WnNqGnb0B2HOn5qmjlt6ScWqmjltZR
MD5:	B26F240D4CFA0B6958EBD54409DCD4A4
SHA1:	763E0C9345915725F0E4BBF5059FDF52C2EB11DE
SHA-256:	B4F7B21D1A96BEEEA1956F7E6448D6DE889C08ED8FA35A1EC4CDEFA0E4DF3A5C
SHA-512:	A243DF0BF985046E1A632B63B2792856F4DBFC5C50A0562AD9431650F7FBBE6FB964A30E5DB72BD63D2D289BD6B1E88BDD3F717559CB4EE23C4057C2468DF44B
Malicious:	false
Preview:	L..................F.@.. ...25.....1>.~....25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DWQ`..Windows.@......OwH.Y8r....3....................._.9.W.i.n.d.o.w.s.....Z.1......Y5r..SysWOW64..B......O.I.Y8r....Y.....................k...S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBIDW.V................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M............\|.z.....C:\Windows\SysWOW64\msiexec.exe........\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.s.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.U.N.I.N.S.T._.U.n.i.n.s.t.a.l.l._.L._.7.8.A.A.5.B.6.6.6.2.5.1.4.D.9.4.A.8.4.7.D.6.C.6.0.3.A.F.0.8.9.5...e.x.e.........%SystemRoot%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C6

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297277075649904
Encrypted:	false
SSDEEP:	6:O49UDz4q2Pwkn2nKuAl9OmbnIFUt8h4CkJZmw+h4CkDkwOwkn2nKuAl9OmbjLJ:OVDz4vYfHAahFUt8hpkJ/+hpkD5JfHAR
MD5:	15C7CF7CF4E513D51D3864891C90ED11
SHA1:	0A546ED68D377195D2B3AC32FF4286F19C38F9FB
SHA-256:	A941DF46F102981DF8DC49DD7100979D31956C9BE56B31A0504B04E717DF969C
SHA-512:	A6704D56082BF759DA9A80E18B929F19614DEAF806299BF4AC063418BA55D0EEFFE773A91AEED7C4E37C0599F2C83C2560D3ADDFCCBD41078B9FE1A6C0297AEE
Malicious:	false
Preview:	2024/12/25-09:17:53.785 1f60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/25-09:17:53.788 1f60 Recovering log #3.2024/12/25-09:17:53.788 1f60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297277075649904
Encrypted:	false
SSDEEP:	6:O49UDz4q2Pwkn2nKuAl9OmbnIFUt8h4CkJZmw+h4CkDkwOwkn2nKuAl9OmbjLJ:OVDz4vYfHAahFUt8hpkJ/+hpkD5JfHAR
MD5:	15C7CF7CF4E513D51D3864891C90ED11
SHA1:	0A546ED68D377195D2B3AC32FF4286F19C38F9FB
SHA-256:	A941DF46F102981DF8DC49DD7100979D31956C9BE56B31A0504B04E717DF969C
SHA-512:	A6704D56082BF759DA9A80E18B929F19614DEAF806299BF4AC063418BA55D0EEFFE773A91AEED7C4E37C0599F2C83C2560D3ADDFCCBD41078B9FE1A6C0297AEE
Malicious:	false
Preview:	2024/12/25-09:17:53.785 1f60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/25-09:17:53.788 1f60 Recovering log #3.2024/12/25-09:17:53.788 1f60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.241058079259695
Encrypted:	false
SSDEEP:	6:O4lqM+q2Pwkn2nKuAl9Ombzo2jMGIFUt8h4TZmw+h4eaDpMVkwOwkn2nKuAl9OmT:OEqM+vYfHAa8uFUt8hO/+hCMV5JfHAaU
MD5:	54F5B2EBE7817FBE9793222E5925E302
SHA1:	E3F279B66AFC236C2EA282BAD0E53D3D87D7A4D9
SHA-256:	B801B20977F5C29A7CB97C58F6998BF21D9095D55F69E65C1959F04ACADC77E9
SHA-512:	C5F833E3C795099C301C6CA1E004E984010B5728A4707DB11CDF5BF0B07ED002198BB7F25C8C0308C13D0849951448B4E3912563FE01C0A521F2DB1C715FD545
Malicious:	false
Preview:	2024/12/25-09:17:53.815 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/25-09:17:53.817 1ffc Recovering log #3.2024/12/25-09:17:53.818 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.241058079259695
Encrypted:	false
SSDEEP:	6:O4lqM+q2Pwkn2nKuAl9Ombzo2jMGIFUt8h4TZmw+h4eaDpMVkwOwkn2nKuAl9OmT:OEqM+vYfHAa8uFUt8hO/+hCMV5JfHAaU
MD5:	54F5B2EBE7817FBE9793222E5925E302
SHA1:	E3F279B66AFC236C2EA282BAD0E53D3D87D7A4D9
SHA-256:	B801B20977F5C29A7CB97C58F6998BF21D9095D55F69E65C1959F04ACADC77E9
SHA-512:	C5F833E3C795099C301C6CA1E004E984010B5728A4707DB11CDF5BF0B07ED002198BB7F25C8C0308C13D0849951448B4E3912563FE01C0A521F2DB1C715FD545
Malicious:	false
Preview:	2024/12/25-09:17:53.815 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/25-09:17:53.817 1ffc Recovering log #3.2024/12/25-09:17:53.818 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1a16fa97-7588-4806-b1fc-8f5c3fc9bd6a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\276d4aac-65f4-4159-83bd-c4d0e139f3a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972348101139995
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqD0hsBdOg2H9Lpcaq3QYiubInP7E4TX:Y2sRdsHydMHC3QYhbG7n7
MD5:	985518BBE2CB9734565E6CE7E18A692F
SHA1:	95D7B35E737946FBD8EBE8BCF5C0227FC410E849
SHA-256:	E641685B005BFB591965710FBE7685E6E78E39F444980B19605A2B5E97D6D452
SHA-512:	B07AE6C282B145E48403BD8DDF570C6609F8C5DF88BE7BE0FF90EEE2D4B5198401FD6F108E5EE1994D317A35D9EBABA2EB01E27CFEDEC4BE53C6E5138C8AE00C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379696282511656","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":630600},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF689495.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254403141194097
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7L8MpH:etJCV4FiN/jTN/2r8Mta02fEhgO73go/
MD5:	07F5DF032E1D00E8DCA6403034E69818
SHA1:	027E7878996A3511812EE534A009C221A45BED9F
SHA-256:	16D06F62B7F2299A9FCCD90BF59794AB52233F37D81A13B68063D71F9C166992
SHA-512:	068CF9C139C695143906A42F65116777D7F352266C8AA32AE1246D3A35DB8012E5304859AB2C6D8ED16A324AF9F363D3C98ADC658C45C8E4AB506DAD8F31A206
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.241419209945517
Encrypted:	false
SSDEEP:	6:O42M+q2Pwkn2nKuAl9OmbzNMxIFUt8h4kZZmw+h4RBMVkwOwkn2nKuAl9OmbzNMT:OtM+vYfHAa8jFUt8h1/+hYMV5JfHAa8E
MD5:	08A17935D35E22F13160E86A58964E7D
SHA1:	80C35C12B1CE2120F366509D5092E5D624E69DBF
SHA-256:	F35B1344F4008D997E79826B572CB0E2791AC79C102BC202EB25F0B068D7FB02
SHA-512:	F9A9B69DFACF943A8447014AA348C77420F4698312AC9050CD0C42200E421FFC88475344EA4ADCE90B01A8B64FAC89AA892F16579E5B898BEFF0BCB08D5F28FA
Malicious:	false
Preview:	2024/12/25-09:17:53.938 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/25-09:17:53.939 1ffc Recovering log #3.2024/12/25-09:17:53.940 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.241419209945517
Encrypted:	false
SSDEEP:	6:O42M+q2Pwkn2nKuAl9OmbzNMxIFUt8h4kZZmw+h4RBMVkwOwkn2nKuAl9OmbzNMT:OtM+vYfHAa8jFUt8h1/+hYMV5JfHAa8E
MD5:	08A17935D35E22F13160E86A58964E7D
SHA1:	80C35C12B1CE2120F366509D5092E5D624E69DBF
SHA-256:	F35B1344F4008D997E79826B572CB0E2791AC79C102BC202EB25F0B068D7FB02
SHA-512:	F9A9B69DFACF943A8447014AA348C77420F4698312AC9050CD0C42200E421FFC88475344EA4ADCE90B01A8B64FAC89AA892F16579E5B898BEFF0BCB08D5F28FA
Malicious:	false
Preview:	2024/12/25-09:17:53.938 1ffc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/25-09:17:53.939 1ffc Recovering log #3.2024/12/25-09:17:53.940 1ffc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4450845456494745
Encrypted:	false
SSDEEP:	384:yezci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rXs3OazzU89UTTgUL
MD5:	4F920F42655298C4A0417904F729FD93
SHA1:	7A0586F94F4CC344577F4F37BA6E052793DC174B
SHA-256:	71FB5B2A3F9E441510C8AFA17BAC976026FF03B4B5514D137D3AA03164F74236
SHA-512:	92B5F92F3CCC132C21745E4760D89EE2C6162E8D06E7B5ED578FE14D9E72394D145A5B247C5BE814B773DDDB263FDB7A80052E3F4E8D5B9B9B5DDA311A2E19A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.776323045932378
Encrypted:	false
SSDEEP:	48:7MYp/E2ioyV8ioy9oWoy1Cwoy1IKOioy1noy1AYoy1Wioy1hioybioyOoy1noy1z:7jpju8FLXKQ/Ub9IVXEBodRBkG
MD5:	2F644DB20119FA89BA7828B8075DD260
SHA1:	3E4C36A2F73B23E5061EA242D980969F88E3D149
SHA-256:	5BE21835A5DF46AA45B20239D3222AC0865515AABF074585C619C250912C4352
SHA-512:	23F118B0D9F2FAAC880096B8FF2E81C52F97F17B10916FAD61949E7057D617D15A797E7F5905D264B1697FE9E351A1AD9FD0B066A816BFD429AFFD98A1B209B0
Malicious:	false
Preview:	.... .c......].................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7895108629891827
Encrypted:	false
SSDEEP:	3:kkFkl3Puz+E/ltfllXlE/HT8kQ7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kKjz+E/leT83zdNMa8RdWBwRd
MD5:	7E370E2030CC9CC82B6E4CD897BB80AA
SHA1:	6EF6D1404A3EFAAA413308CDD8F4B5AAA240E0F8
SHA-256:	2377F2710A14FD4549550A20923D7FD5B0CF875DC39D2B32DB10E7071485347E
SHA-512:	977E10CFA9034E156C705AC1A03BA5CCD7F9BA8DC67B217111E4FA0ECF2D9A8C4B35A3DD863614A817A22697ED2513A077B0E73794B9E3E8195FD48FE8619FC8
Malicious:	false
Preview:	p...... .........j$..V..(....................................................... ..........W....3...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKKSklL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CaDnLNkPlE99SNxAhUe/3
MD5:	BC7FF87976B08CD9993F6D1F46C46525
SHA1:	985C82B808C941D1B1204399C597048EF7CBFEAC
SHA-256:	D3B10DBD4F925A54F286B309DD585844C19CD7B5D699C5FCF3967A34A2058014
SHA-512:	184BE0A6A90E9900231D6BF8CA71246B88778793CB3DEC9ECAAFC1C8899BCC57E12BAA3038AD32A054A2E3A6E053C9360765DB5CB4B242858E43F563831F3EC3
Malicious:	false
Preview:	p...... ........l.U..V..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37498520163792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJM3g98kUwPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGMbLUkee9
MD5:	955D083D3A3749BE235E2D2C4496A9A5
SHA1:	8B4F5B9F062413561998DBB90CF01820412F952F
SHA-256:	43D0E23D749E7FC6CE9E68226AAA3DA47ACEEE268534200ABC33253BB9069EBE
SHA-512:	E88F9F41999C61EC22FF1B9DFE0E239915E349D50F4ACAF441999F1DFC3DA85E36EEB058F0A64E706A08A6592D5419873BA02316F636709411D93139728BFAC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.323327848505493
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfBoTfXpnrPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGWTfXcUkee9
MD5:	8B196AE35071174CCE247E5E5C18744E
SHA1:	3133F1F47C558BD41A9FADDA55F31C96B5744E39
SHA-256:	D402D631727E0829F9707222AA739022FE75B3CC9A378B425AFD33817A78CDD8
SHA-512:	EEFD29C036A6B7414E93B57B4C1B62779CBDC2D9BF8AE06723374C4779B17E4398AA4BFD741830D50DDC729AAFD6EB534057DC6D1917ACB2FC9CB9428DB3FD72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.302595642420163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfBD2G6UpnrPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGR22cUkee9
MD5:	34D623D2E1A7073A607F449E47C457A0
SHA1:	7B91EA431F7DE84872596DE5482E01C578120296
SHA-256:	CF47EDEE22FDC61755845E0CF36F707C529093A544CE9ED5E55F4550A86B0953
SHA-512:	FB390F8119082DAA351AA5EAAA625C4B22896ED5FE99165C8CC911B5FCF69966E69C5F8CB54FE60DFA95719E15372EEC072B6EA847F81B9E3398AF02C03DE579
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3624034908267895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfPmwrPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGH56Ukee9
MD5:	C524716AC4016D8CBAD3E1AD9AFA09E9
SHA1:	3539A80F28A38099616E60CE3D3268268EC6556A
SHA-256:	1FD9E31E054A5AA73A8B5305CF9B7E5AFA465BB17ED318A34312D1D0DF730E81
SHA-512:	975229CFE3ECFB65BCA3F555A77117BAC1A6357623B5649033C0136DCA545C795C3EF47F373BF0B4D12A1401641EBE06E203B1847134C79D30532F1842A263FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6826803389621015
Encrypted:	false
SSDEEP:	24:Yv6X5qHJN2zvispLgE9cQx8LennAvzBvkn0RCmK8czOCCSz:YvGqHuashgy6SAFv5Ah8cv/z
MD5:	B59A7D35BC6D8C6DA41509243A59EBC1
SHA1:	D5D9481FE779CC0FFD2E690EF780F50C9C39AACA
SHA-256:	301514D153A9A8EEDB9968599622B8A0906E260618B49FD72CDABC0174B1DE48
SHA-512:	3C613D5A546B9E537000CA5424F89B89792C324CB8AF4044A4F8F5DAB44022BE29821071C2D8710E2EDAD977C4B2AD351E7DDF7F9DB5D90AEB66C6EE35E00C14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3056339236755035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJf8dPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGU8Ukee9
MD5:	B0F611320882D8F60C72448D0FE06F9D
SHA1:	9D0E992CB2ECCF8ABECB0E7F7879937B372ED26E
SHA-256:	09959D55638F341327ACD6C1A2174D0706FDC235677D9A665F96B32665D1ADFC
SHA-512:	8FBE46993FEA38D6E0AD8D003E279E98EFFB89EDCF53F3F25C2D9A9AD42DA7A6ED67E426A21937D27F37041BE67EE245E184FBA8D9866DF392D5D10ABB953B60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.308893052412268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfQ1rPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGY16Ukee9
MD5:	9CF5B7E049026922E6439791F883C38F
SHA1:	04731248897A3CF90BEBE996D7E7783968039692
SHA-256:	94F8C3B33FCAFB6B334EA673468464ECC2BCD1F64699836EC25A651FBE31BB0E
SHA-512:	DC25B99560005D7F71DAF0B15134E28DD934A180559EA950D41782C905E0F30ED8285AF3028DA9C7766D41280A696A9D0971BD51E2B23E982E068944C876ED4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312259840247327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfFldPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGz8Ukee9
MD5:	3D4FCC0936E3C68443CB97545B80D01D
SHA1:	C2D8D1862BABDFC629C32CBE8DD175CF6FBC3A2E
SHA-256:	73DE0BC06D95B778BC4D338B0CF6FAC30DB1AAB7910DC223EE8793772AC46C8D
SHA-512:	CD00B6C986ACD136561EDD34C1CB030E4AF98E14DBE7593C7121284133B2B30D625657F40979BB8B8B39CC6AF987415C06B5B783591240B288E8BAD4ABD22392
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330564617888576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfzdPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGb8Ukee9
MD5:	9AD2FD0739728BC5F67956F3693F36BF
SHA1:	3F32B969F645954EDCBC45E6CE0CDA94E15D0208
SHA-256:	35BBEDB4E556FCE8A7FB036BC7AD8F9AA4FCC8591481DF3505E974C033C98A27
SHA-512:	758521911E2F96FA41CA1CB951623F208E96F8EA096200444309663572AB78F2230C4931E870520D90CE0D3600F33FA815BD81918F7A585A2DBF115749C5D693
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311147089237939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfYdPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGg8Ukee9
MD5:	258803A0B0A18DA2A6FC8B2227C45209
SHA1:	14FB5D59CB17FFF0A2C6E66558044F1109204873
SHA-256:	F20B3091FA7DC6ED1DB4665BC4EAE62C2E69AB7490472BB044B57860EC92B4D6
SHA-512:	FC1AD2E6C7B05F46EE22C744F1C4290A410F63B03FAD2F0639AEB9C45AD93CEA7E0291C4CDF6E9522802A871C04B8A95F619BDF8C9842E0688BD5AF77807C968
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297975067252363
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJf+dPeUkwRe9:YvXKXFzqHJN2Zc0v0JnG28Ukee9
MD5:	74BE2D320D4496811B07ECBF1C9E27DA
SHA1:	CEABB779B6D27A6AA1803BECB69CF78AE8D4136F
SHA-256:	80F036433483D9347A93A95C694D18DEED4BE753D1FB2596BFDC15C18ADEB162
SHA-512:	2D8F3260E85408A82B6924D83C62FFD79C298EFD4BE7E921E7DFF875236EF69538753AA84EA29B103E977179567C1BF352825D259048DA94AE3158A0C3F7274D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294617574614634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfbPtdPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGDV8Ukee9
MD5:	1C1F1DA46C9C51558F00ED801575C69A
SHA1:	971F932E8A720D5074BE253A28B82D706F1D6368
SHA-256:	BF3D0CB9DA697345195A72576FBD4D3C88A26C87F4DA83C8EB44F60FC9E95CA8
SHA-512:	B428C46DA3C712C7396EB79754773BA2EB14C4D44F5B4632CF1BFBBDC097D0ADCCA1AC654AC6A2165BEC184CA818DFEC49DC16721798B3E9F5C3FAB812BF02D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.299108939001311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJf21rPeUkwRe9:YvXKXFzqHJN2Zc0v0JnG+16Ukee9
MD5:	F3A70AD68229D073B6F4B5956E02750C
SHA1:	A25DE6E38F2896D56E2BEB2052684295F62568DB
SHA-256:	010293DFB54CD43A9C2F92B17F44449F427B9F5568548B20A6E0F1A19C1D721E
SHA-512:	85BE05F5EDF9D78D619B81C1D1211EA031DF421344DFE2D712660D612D6CB9CE2AC2728DC0500971A831C65A1A2AFA09FC7172A1DE15A8DF087CBFA13CEB9062
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658964280083354
Encrypted:	false
SSDEEP:	24:Yv6X5qHJN2zviYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz:YvGqHuaeBgkDMUJUAh8cvMz
MD5:	BAC96BBB0489A936A01882362A0C6D5F
SHA1:	7011D32138EF9BC7C93E57CBFE380AFC22E96D12
SHA-256:	A3194DA05B1F4BFE2B21901187CDCEE0231A8077991573F6E3E5E743F9F991F1
SHA-512:	DA65745E01D25406E696012EE40319A08B1425E1A3425AFF1CBA305EFC4650FB0250DBAA73F90FA17C1CF28BD50BA83609213488A9D0A62B85D7A460C03F189E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273184334442483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJfshHHrPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGUUUkee9
MD5:	F62791FC839671F8177B4C825BB3A3B4
SHA1:	03E3EE00BB03CDE5D7278C521FD90F520C640864
SHA-256:	78102288AA6B1FC611A9B4AF0C99ABA3442C5734148368D8CD65FF99950BE567
SHA-512:	A23DBA096478A1B26D0351D20C7D2F39F5A32A941148B43E397F43067B93E0E36A6AD780443674C616CF72389F920A84A75C820B2D95DBCAE274C3604C32D71A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.288041010955499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzW2ZNqHJNV9VoZcg1vRcR0YB1JYxoAvJTqgFCrPeUkwRe9:YvXKXFzqHJN2Zc0v0JnGTq16Ukee9
MD5:	6B5311F0D203BD22E8716B914F5339C6
SHA1:	A3AF75E1CF0A4E2AB34D5D500A7A82FA6784A21A
SHA-256:	0C3B734683387A61F33039A612D01A9426FC82BC0B9342DF142CB8C40E44DCC8
SHA-512:	869700C84D27CD175C05EDCC1B77F4BD6CFFFF17C014062A29D048A229C5833F839763D1DEFF84713D15F90B15878F0536DBC98375AB80F3E48D1CB49F5F785C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ce512460-ade9-4ed5-8f16-b06d91fb6dd9","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735312354915,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139111679020927
Encrypted:	false
SSDEEP:	24:Y0xfha4HWayVV4EnX99/yBlDUPj/j0S5tSFgZ2LTD2LSbCGTCcEiHKq5+Vh9GuGj:Y0qKu3/y8L7SFAKTD1lCcEiHj2h9+
MD5:	2617664E85F5CDDB91D966C1BCFB00C2
SHA1:	24D5F84F5864E18EA77D77A60A2303C40AE85294
SHA-256:	732B139138C6C5DA22611DE0511DE107E212A5F1E6389BBA63705416B9D23577
SHA-512:	947458EE80BE5EFDFB9DB92EEBD39BCC510ABC9C133BB930EAC1C5594D580FDA25013460E93FD0B330D23408EC442E3AEBB300E9A17A0C530FBA6F4DE32259AA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e1eb4a4f51870eee8bf09cda17f0006a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1735136284000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e49bacefde005d6a78960c3c5ae934b2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1735136284000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"374a6ccd5717226e1f49a414321f47cb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1735136284000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2c7abb5e92fea44293b2b16934fd7946","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1735136284000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2ea932172e1104f585ee2f37a12f107f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1735136284000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0b2c0ca14d049d2a9da90d7b035e7af2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1864697069856829
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU0SvR9H9vxFGiDIAEkGVvpG:lNVmswUUUUUUUU0+FGSIta
MD5:	DAF48492FB44450173E1DF5EB4D1EA69
SHA1:	C87DFA11429D6BA3E649C36371033228AAF8CCF9
SHA-256:	33606D0F4E99E8CEAE23226BF01464B301F939B346A4832939582BEEA4440954
SHA-512:	4899395DDF5AFB744317B7A020826911110DED6B1FE9B223C42A7367A9E79B8C71DD5D9E9BC27CFB20148AE16A15469807E8F0619613F03A9EA59F7F9888FB48
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6051568109538437
Encrypted:	false
SSDEEP:	48:7MYKUUUUUUUUUUWvR9H9vxFGiDIAEkGVvYqFl2GL7mse:74UUUUUUUUUUaFGSIteKVmse
MD5:	9ADF1544CD7350DD6DDCB36028779880
SHA1:	1DFB556A676D329B5467A75D372C3CC8F1B13D54
SHA-256:	EE97F05735917F66C3A51F47D9504D046248EAA6C58842498FCE81044C95293A
SHA-512:	E5D9EBD108088735BBDF8CD49157AB4C46355112E0F9A8E82D2E3E0750BCBFA781DC377CC053D923302023C87243D1B10BFDCA32B59705352DFB1AFC799FAB4C
Malicious:	false
Preview:	.... .c......$~~......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgDNErfI15MAV8GUtnLLgk2hRYyu:6a6TZ44ADEDyrfI15JV8yRK
MD5:	8FBE4CAE54C6F5E581EACAD8DF8F688F
SHA1:	7538A1124197F5CA553090B26000AF2D317CF964
SHA-256:	01B589D3226F72DB8BA75774CB980CEC721E74851E8E3233E6C17191EE85A00D
SHA-512:	C09F23D215612F404B8927787A23506EC38E796748B36B655B1DEA27665522D2C9BCB062A87D9DCBDA5D3453444AD9D77DD81736EB6484314F355D1978E533FE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-25 09-17-55-971.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.370831016789047
Encrypted:	false
SSDEEP:	384:Jg0Zll8USIHXiICduhIv5IZBaBEdRttA2F6Gsk0XdRxLqaZLXuxu7W+QKRpxxnW/:FIuD
MD5:	58080CCCC22AE0742917002B5E8D8B6D
SHA1:	11BBA1A464251F76DA0B969EDBAA14D85E619AA3
SHA-256:	E7A226186F3AF122C9F64E699C9F72B6E3D9980D38B4DF486B79A74C3A53C4E5
SHA-512:	2CDE73A2E46929A571D26CE7211F19B3238850CD9A28ACEF50F2FEF837BA096A25CE0E4B16D3BC416FC143A961A9A0D793E00E5E7D4F62C46B9F1B429C3925E2
Malicious:	false
Preview:	SessionID=419d898b-4e29-499d-8bee-93fb104546cb.1735136276023 Timestamp=2024-12-25T09:17:56:023-0500 ThreadID=8072 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=419d898b-4e29-499d-8bee-93fb104546cb.1735136276023 Timestamp=2024-12-25T09:17:56:024-0500 ThreadID=8072 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=419d898b-4e29-499d-8bee-93fb104546cb.1735136276023 Timestamp=2024-12-25T09:17:56:024-0500 ThreadID=8072 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=419d898b-4e29-499d-8bee-93fb104546cb.1735136276023 Timestamp=2024-12-25T09:17:56:024-0500 ThreadID=8072 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=419d898b-4e29-499d-8bee-93fb104546cb.1735136276023 Timestamp=2024-12-25T09:17:56:025-0500 ThreadID=8072 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396988175382458
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rD:v
MD5:	CFAA5782905D78F8C7C81209AF6DBD71
SHA1:	C5DF6718D567FF4986A46FF6B56C1E5234610B07
SHA-256:	7A5B44BF7E8B52D997912EBF6269AD67E2968D3018FDB4181384969A9B0F8FFD
SHA-512:	8A987B8E322CC1CC477A788890C5B9EA879090AA329D2EF40F0D3559964487D5DE14E2272954FF5469C2F078A463683EC0B683EB1379D327B349D7FAD6BDC3F0
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5114ee66-15b3-4d93-b3f2-5380c1c8fbb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\58610d33-5cd2-4bae-a8c1-bafdc85009c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\678a997e-4184-4e23-9629-88d073f1c131.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f4cc0aac-6786-4ac9-ab04-da6064132365.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\doc.pdf

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	85137
Entropy (8bit):	7.7513343990244366
Encrypted:	false
SSDEEP:	1536:eyetDLuxUTpyWbzUGW7EmvP95imdqYKq6i97idLfnk:eyetMk1tCPfimdsq6ididL8
MD5:	17A9D7D59ED8076A38B9E48533A01A10
SHA1:	1EC63D0BECCCBCE15277A3C227E787131C1E8F74
SHA-256:	631C4D8C4D0DE76F18712484358E532BE32F2FA2F92D7FAB026406C346ACBCDA
SHA-512:	E3C8AD153864482AC0BDE7445DAFFF1DAC9DCBC48D83C99169388C2EEE832EDDB02B4A2553F60D81E93674F76880544F4C10F05098830E7931518D14DF1DCFED
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(ru) /StructTreeRoot 37 0 R/MarkInfo<</Marked true>>/Metadata 351 0 R/ViewerPreferences 352 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R/F5 24 0 R>>/ExtGState<</GS10 10 0 R/GS11 11 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 1237>>..stream..x..Ko.6.....w.1)`...C.....Z4...r.z.!..F....J...).+.`.k...>....o4....._........V..<>.7_..>.=.T.6....h3...A.e+..U`...o_..O?.......{P....m..>m..`5..g......{w.F=......!L.w.....6.iLK.._..O.]...a.S..F...I....~.x.nL......}.;J\|..>....d..L.....=...QB[.4p^[..t.dB...!.=.......v...]h.0F.......C....5&B....Yoz.n....c[W<........'. .1.9?...m.).hG.)!Zm...:..K(I.d...\..s..%.

C:\Users\user\AppData\Local\Temp\doc2.pdf

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	85137
Entropy (8bit):	7.7513343990244366
Encrypted:	false
SSDEEP:	1536:eyetDLuxUTpyWbzUGW7EmvP95imdqYKq6i97idLfnk:eyetMk1tCPfimdsq6ididL8
MD5:	17A9D7D59ED8076A38B9E48533A01A10
SHA1:	1EC63D0BECCCBCE15277A3C227E787131C1E8F74
SHA-256:	631C4D8C4D0DE76F18712484358E532BE32F2FA2F92D7FAB026406C346ACBCDA
SHA-512:	E3C8AD153864482AC0BDE7445DAFFF1DAC9DCBC48D83C99169388C2EEE832EDDB02B4A2553F60D81E93674F76880544F4C10F05098830E7931518D14DF1DCFED
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(ru) /StructTreeRoot 37 0 R/MarkInfo<</Marked true>>/Metadata 351 0 R/ViewerPreferences 352 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R/F5 24 0 R>>/ExtGState<</GS10 10 0 R/GS11 11 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 1237>>..stream..x..Ko.6.....w.1)`...C.....Z4...r.z.!..F....J...).+.`.k...>....o4....._........V..<>.7_..>.=.T.6....h3...A.e+..U`...o_..O?.......{P....m..>m..`5..g......{w.F=......!L.w.....6.iLK.._..O.]...a.S..F...I....~.x.nL......}.;J\|..>....d..L.....=...QB[.4p^[..t.dB...!.=.......v...]h.0F.......C....5&B....Yoz.n....c[W<........'. .1.9?...m.).hG.)!Zm...:..K(I.d...\..s..%.

C:\Users\user\AppData\Local\Temp\ms.msi

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\start.bat

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.924404357134264
Encrypted:	false
SSDEEP:	3:mKDb2nppLJTXZkRErG+fyM1K/RFofD6ANntch9wQn:hb4ZGaH1MUmy2Nn
MD5:	AA3AAB4A5BCA1D06B08C6F5D6362A5D0
SHA1:	486D423A2B689CC119CE95DFCDC018C7B552FA24
SHA-256:	A0A569883E851B4B965088F9ED9F9FBA80803B47AC6E6DD4B07DF60435184CD4
SHA-512:	2B5F84DFB399F313D11A8BFA2F3F3338CF69711D5C7B6D86E7F876C8B64DB3A664D1E3E4A4A4B0066A6949DE4E64CBA416A40BE56461556F9216EE82DE23D913
Malicious:	false
Preview:	@echo of..ping 8.8.8.8..cls..del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\." /q..cls..exit

C:\Windows\Installer\675fde.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\675fe1.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI6694.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	292991
Entropy (8bit):	4.840173256491118
Encrypted:	false
SSDEEP:	3072:ghoy2KjcC2jcmFDX/vjcJGUjcmFDX/rjcmFDX/dZ+cNbynfe:ghoy25DXmNDXLDXX+cNbynfe
MD5:	57A2D1DC232E07904588CC6311B7DE27
SHA1:	33108C40A5FB9C483FC09D1B9D96BFA3B89453F4
SHA-256:	9E379EF011A43B7D9D1368FE5B1D894A5012913BD9507A479B9EE21968F0B298
SHA-512:	E55715FB91DC1D84DCFBC6F06B8543DD40D120FECAA663F63D6DD069491C860E242F68B789958B840F0A7653CE53BA9B23FE40AFC23A694B1ACB99A18775E105
Malicious:	false
Preview:	...@IXOS.@.....@;J.Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..ms.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{3244CDE6-6414-4399-B0D5-424562747210}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}5.C:\Program Files (x86)\LiteManager Pro - Server\Lang\.@.......@.....@.....@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}C.C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{596F4636-5D51-49F

C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.160389187135861
Encrypted:	false
SSDEEP:	12:JSbX72Fj76AGiLIlHVRpBh/7777777777777777777777777vDHFfbe2vtJW4pOz:JkQI5V9dviGF
MD5:	7729ABA74203D8FA9CC126DDB7A57EE6
SHA1:	A3E320E3C82146D0122AA99818384A898EF21BDE
SHA-256:	901C176A630F703B13BFAAE26698E1920A5B78AA328544EFAC46A7C9EE639A72
SHA-512:	6744AEF66877B429DAB15FBC419A8F53043476A6DAFF2518978F9D85AF4AA6843ECA0DD789CA87150ADB99DA8C768CF9F3BCE2B7870417B7917915E4D177CFB1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7854295991793094
Encrypted:	false
SSDEEP:	48:G8Ph+uRc06WXJSFT5vR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29I:Zh+1JFT2nm0WlfPuDqC0WlfIF/
MD5:	3AF45C20F2B40188B88AE48F9B91EF90
SHA1:	47705C6ABEE31E02FB411E89282B15B72F8FBC26
SHA-256:	D5BFCDE192A28E49A5481B04AC005F2F49A5451CA4B774F8789E13917EB4262F
SHA-512:	A6D6FF95F3FDEEFFB30BC4ADF4C85CEDEB0CA79D403B1A7F7647ED5DFCCD8BB5BC308FDE9A50F386EEECB92BD6AD0EE86FE840543DE43CF8B03BC12FA93A4E5F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.351781833522881
Encrypted:	false
SSDEEP:	384:AvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZUNeLNek+vDFNe+TNy:+MAyYdTmPJbgqcnDcCNy
MD5:	CA680899D9330BEB85E6351E6DC0D27B
SHA1:	41E89E582F58FB2A4ED06FA3BF796A1DAAC5CB6C
SHA-256:	EAB5DC45781E92CD5CF953016757B1E6F2ED7A0B5A97CC0945B19A8FBC1A85F2
SHA-512:	3817BD6EC345F96631E6CBF6C8DD384ACB17D912B1EC69D959F3AA15C05226D5FE3B5E9807D42D0E63589AABCEADFBE8BD5F293D8069DF689D12498E05842286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(........0...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.31126714354722
Encrypted:	false
SSDEEP:	384:EvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZMwQE3vGYksuektm6yysZc8:SMAyYdTmPJbgqcnDcmwQE/RkHRRNS
MD5:	6A4AFFF2CD33613166B37A0DAB99BD41
SHA1:	FBC0F1696213B459D099A5809D79CFC01253880F
SHA-256:	53C1AE4962663E82D3AAC7C4A6CBE3D53E05D6948ADAE6391A2748396ACF98FE
SHA-512:	7B61D32E4AD38BC21E86559BFFA49A334CCB6184E595CB43F2D60A2A77C86B31D07B1A9D1F8FBE69E9AAD7E096952D765404BEBC494E73BD992642EB6B82E3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...p...............P....@.........................................................................4T..(........+...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....+.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375167557191022
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaux:zTtbmkExhMJCIpErM
MD5:	D18E7F647593113ADEB0D5BC2176E84B
SHA1:	5B1A5A6E1E5BDDA06D8D2F39182A1E30F376C563
SHA-256:	130D3D52A97BB0D68B2A5FF17E2B1BB9BA24600CDA082FAD8D32D7DD12AE8DEF
SHA-512:	9A00861D1128D06B7E06CBB39F4684743533FA9E9A81D4EB25AAE6C8E0997E6C43AA1211FF202CA7B909664C0BEDF9D57D238453598832E8CCF1C84D1881CE31
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\~DF01B22DBE96513524.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7854295991793094
Encrypted:	false
SSDEEP:	48:G8Ph+uRc06WXJSFT5vR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29I:Zh+1JFT2nm0WlfPuDqC0WlfIF/
MD5:	3AF45C20F2B40188B88AE48F9B91EF90
SHA1:	47705C6ABEE31E02FB411E89282B15B72F8FBC26
SHA-256:	D5BFCDE192A28E49A5481B04AC005F2F49A5451CA4B774F8789E13917EB4262F
SHA-512:	A6D6FF95F3FDEEFFB30BC4ADF4C85CEDEB0CA79D403B1A7F7647ED5DFCCD8BB5BC308FDE9A50F386EEECB92BD6AD0EE86FE840543DE43CF8B03BC12FA93A4E5F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF17DE007D8D7292CE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF281CC7BD9777D73E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF391BD5B2C1FE8CB1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7854295991793094
Encrypted:	false
SSDEEP:	48:G8Ph+uRc06WXJSFT5vR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29I:Zh+1JFT2nm0WlfPuDqC0WlfIF/
MD5:	3AF45C20F2B40188B88AE48F9B91EF90
SHA1:	47705C6ABEE31E02FB411E89282B15B72F8FBC26
SHA-256:	D5BFCDE192A28E49A5481B04AC005F2F49A5451CA4B774F8789E13917EB4262F
SHA-512:	A6D6FF95F3FDEEFFB30BC4ADF4C85CEDEB0CA79D403B1A7F7647ED5DFCCD8BB5BC308FDE9A50F386EEECB92BD6AD0EE86FE840543DE43CF8B03BC12FA93A4E5F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF45A596A2E56EDEF0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4FD5132D631A595A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4145946496957054
Encrypted:	false
SSDEEP:	48:flWuDO+CFXJjT55qYR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29l2:dWf7T3unm0WlfPuDqC0WlfIF/
MD5:	4A6FF06B0471F5935EE96E09398A766B
SHA1:	528A1DBEBB3E7718D8166883E29378EF34E3CD53
SHA-256:	C74B0FA1252E2E4625EA89DA3DCC080306FF76C131E81638D2E02C52C52BD88D
SHA-512:	8405E1519CC93BEA8782C8D58CA7C7E52372590F779ECDD8F3990A6EDBDE3F584760852D6B610C2915C63E3C41297B4DDF1FC4644315B020C3C698B9071B195B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF539634D9F35A6A63.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4145946496957054
Encrypted:	false
SSDEEP:	48:flWuDO+CFXJjT55qYR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29l2:dWf7T3unm0WlfPuDqC0WlfIF/
MD5:	4A6FF06B0471F5935EE96E09398A766B
SHA1:	528A1DBEBB3E7718D8166883E29378EF34E3CD53
SHA-256:	C74B0FA1252E2E4625EA89DA3DCC080306FF76C131E81638D2E02C52C52BD88D
SHA-512:	8405E1519CC93BEA8782C8D58CA7C7E52372590F779ECDD8F3990A6EDBDE3F584760852D6B610C2915C63E3C41297B4DDF1FC4644315B020C3C698B9071B195B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF568C9AB389B9EBDA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4145946496957054
Encrypted:	false
SSDEEP:	48:flWuDO+CFXJjT55qYR9cxS9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YJo9ISB29l2:dWf7T3unm0WlfPuDqC0WlfIF/
MD5:	4A6FF06B0471F5935EE96E09398A766B
SHA1:	528A1DBEBB3E7718D8166883E29378EF34E3CD53
SHA-256:	C74B0FA1252E2E4625EA89DA3DCC080306FF76C131E81638D2E02C52C52BD88D
SHA-512:	8405E1519CC93BEA8782C8D58CA7C7E52372590F779ECDD8F3990A6EDBDE3F584760852D6B610C2915C63E3C41297B4DDF1FC4644315B020C3C698B9071B195B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7A5000F498DA093E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.22109522704275247
Encrypted:	false
SSDEEP:	48:PHwmFSB29lOd5YpRXd5YNd5YGd5YMd5Yu9mSvOd5YpRXd5YNd5YGd5YMd5YP6AdG:PH5FqC0WlfVm0WlfPuk
MD5:	DEDE62310150853A30A1821A9C141B07
SHA1:	A5AC19EA6D5783CC8A14ECC8692374BF0A83C5A3
SHA-256:	42399FEEDBDEA09F83A8374ED45927D0B83083567C465D0721085164EE7C3C9F
SHA-512:	CF43AD556DC267664179A05178AF8EB4EE7D720C9F199B4337D9AC9E99FC14A5E07FF39BD2AD43424D1823CB53B331B49DD427124FFCD65E3082D75E24C30618
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC16E31734763CC84.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06712149920142403
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO0AbuJ2vWEJWM1AVky6lO:2F0i8n0itFzDHFfbe2vtJWuO
MD5:	0E8B611CF5EFD5D7F4C345B5C4E1443E
SHA1:	88A30155409C7EF376FB080774D617FCD51EEB6B
SHA-256:	1DDAF54603271883C75BDB3FB0D5D7FA324500D3ECC46649D583F73FE82FBB4D
SHA-512:	6AF62D7F4423FD2635320D0E94D40F31502581BF4CE800729F8040E6A962D4E178DDA94B8C10499FAF03C37BF914598A14B1539FD2A18B83A90958235CA131EE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE7C538818459BF58.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE8394AD7E27ABD1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.988555676370944
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0442.pdf.exe
File size:	11'409'543 bytes
MD5:	4f6b2b9ee57c50d6c505d0cdada4803e
SHA1:	ad7dee6f1f71c4fe6299170a160592f139390e12
SHA256:	62410e8399acf7834c74012783bde3fe9ff244e048141c4a96a65bec06895f37
SHA512:	43607bd5bd78dea051340a684ad3311172adc590e5ffcd8a7c576e3f6ddba7e13750bab2a957b4d9fdec0d68b67d5391e779ee625006d00b82a65ecfc62525ce
SSDEEP:	196608:rqwdhlYLDYm+q6yU4zpDKpuLkQ9aP8F5hidaKsv7kDXFd+bIYW2LJjIeTF:Nw3Yi6yU4zpDeuREkF5PlgP+0ijIeh
TLSH:	75B6334AF79008F8E0E6F67485778425E6723D4E1338A59F57A83A2B7E773118C36722
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0fd88dc89ea7861b

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F26FCF57AC8h
dec eax
add esp, 28h
jmp 00007F26FCF5745Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F26FCF568E3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F26FCF575F3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F26FCF59607h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F26FCF45E73h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F26FCF586C2h
int3
jmp 00007F26FCF5E8A4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x154f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x154f4	0x15600	830fe0401acd1728e669a91fa1858e36	False	0.2520559210526316	data	4.6583703321340835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x70554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x7109c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x72648	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m			0.14468236129184905
RT_DIALOG	0x82e70	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x830f8	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x83234	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x83320	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x83450	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x83788	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x839dc	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x83bc0	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x83d8c	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x83f44	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x8408c	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x844f8	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x84660	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x847b4	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x848c0	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x8497c	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x84b3c	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x84d8c	0x14	data			1.15
RT_MANIFEST	0x84da0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 15:19:06.920768976 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:06.934134007 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:06.955125093 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.040307045 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.041426897 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.053591013 CET	80	49797	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.056729078 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.056948900 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.056967020 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.072685003 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.072702885 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.074604988 CET	8080	49798	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.074661970 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.088037014 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.088047981 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:07.176476955 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.176635981 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.192290068 CET	80	49797	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.192307949 CET	80	49797	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.207639933 CET	8080	49798	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:07.207751036 CET	8080	49798	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:08.578593969 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:08.581995010 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:08.581995010 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:08.581995010 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:08.581995010 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:08.701704025 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:08.701714039 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:08.701721907 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:08.701730967 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:09.495721102 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:09.541109085 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:09.645742893 CET	80	49797	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:09.645802021 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:09.645860910 CET	49797	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:09.659758091 CET	8080	49798	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:09.659815073 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:09.659852982 CET	49798	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:09.765438080 CET	80	49797	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:09.779836893 CET	8080	49798	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:10.510844946 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:10.556956053 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:11.517754078 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:11.572586060 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:12.529310942 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:12.572371006 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:13.533680916 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:13.588073015 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:14.544060946 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:14.587990999 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:15.549145937 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:15.603698969 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:16.564587116 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:16.619262934 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:17.575560093 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:17.620232105 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:18.577439070 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:18.619254112 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:19.593060970 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:19.634896040 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:20.596522093 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:20.650495052 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:21.605573893 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:21.650584936 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:22.619308949 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:22.666276932 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:23.626682997 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:23.681792974 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:24.640824080 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:24.697382927 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:25.656789064 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:25.713255882 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:26.659885883 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:26.713016033 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:27.671876907 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:27.713095903 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:28.674236059 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:28.728638887 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:29.684833050 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:29.728662014 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:30.693203926 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:30.744301081 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:31.705435038 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:31.760135889 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:32.720879078 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:32.775522947 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:33.738069057 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:33.791167021 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:34.751682043 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:34.806771994 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:35.768925905 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:35.822415113 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:36.768850088 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:36.822417974 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:37.785299063 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:37.838130951 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:38.801425934 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:38.853785038 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:39.805129051 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:39.853708029 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:40.820816994 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:40.869304895 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:41.828681946 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:41.869311094 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:42.840951920 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:42.885036945 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:43.850033998 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:43.900579929 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:44.865190983 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:44.916184902 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:45.881397009 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:45.931837082 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:46.882805109 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:46.931821108 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:47.898336887 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:47.947442055 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:48.920522928 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:48.963084936 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:49.930217028 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:49.978713036 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:50.930820942 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:50.978708029 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:51.940610886 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:51.994333982 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:52.948999882 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:52.994357109 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:53.963340044 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:54.009951115 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:54.978641033 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:55.025589943 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:55.994407892 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:56.041213036 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:57.009879112 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:57.056843042 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:58.013906002 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:58.056866884 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:19:59.018045902 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:19:59.072665930 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:00.033715963 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:00.088088989 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:01.033737898 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:01.088145971 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:02.041532040 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:02.088108063 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:03.056952000 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:03.103992939 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:04.072701931 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:04.119363070 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:05.091375113 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:05.135041952 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:06.104381084 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:06.150616884 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:06.919121027 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:06.946986914 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.039208889 CET	80	49932	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.039494038 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.056998014 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.057013988 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.066626072 CET	8080	49933	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.066917896 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.080259085 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.080270052 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.144094944 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.177315950 CET	80	49932	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.177361012 CET	80	49932	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.197494984 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:07.203052998 CET	8080	49933	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:07.203083992 CET	8080	49933	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:08.135210037 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:08.181865931 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.134885073 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:09.181977987 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.631125927 CET	80	49932	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:09.635356903 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.635544062 CET	49932	80	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.658351898 CET	8080	49933	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:09.658488989 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.658646107 CET	49933	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:09.755065918 CET	80	49932	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:09.778192043 CET	8080	49933	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:10.151740074 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:10.197498083 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:11.165924072 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:11.213206053 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:12.203087091 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:12.244371891 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:13.181973934 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:13.228768110 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:14.197659969 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:14.244551897 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:15.212843895 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:15.259998083 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:16.229521036 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:16.275645018 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:17.244019985 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:17.291244030 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:18.260327101 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:18.306904078 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:19.268430948 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:19.322546959 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:20.284727097 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:20.338246107 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:21.300977945 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:21.353785992 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:22.301737070 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:22.353786945 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:23.302803040 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:23.353878975 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:24.318523884 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:24.369412899 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:25.333872080 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:25.385209084 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:26.350375891 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:26.400680065 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:27.413506031 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:27.463258028 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:28.382006884 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:28.431898117 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:29.396682978 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:29.447750092 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:30.412107944 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:30.466821909 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:31.428072929 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:31.478923082 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:32.446366072 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:32.494412899 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:33.459460020 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:33.510051012 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:34.486742020 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:34.541292906 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:35.490000963 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:35.541304111 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:36.490552902 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:36.541318893 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:37.506342888 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:37.556922913 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:38.521626949 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:38.572655916 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:39.537583113 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:39.588444948 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:40.552777052 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:40.604980946 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:41.569416046 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:41.619441986 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:42.584244013 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:42.635065079 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:43.599801064 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:43.650729895 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:44.615621090 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:44.666332006 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:45.631401062 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:45.681957006 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:46.646765947 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:46.697571993 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:47.662430048 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:47.713280916 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:48.678975105 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:48.728864908 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:49.693727016 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:49.744452953 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:50.709373951 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:50.760087013 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:51.724971056 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:51.775748968 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:52.740974903 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:52.791341066 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:53.756454945 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:53.806974888 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:54.788439035 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:54.838202953 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:55.780993938 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:55.822627068 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:56.803252935 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:56.853869915 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:57.818536043 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:57.869471073 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:58.834177971 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:58.885273933 CET	49796	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 15:20:59.850004911 CET	5651	49796	101.99.91.150	192.168.2.4
Dec 25, 2024 15:20:59.900749922 CET	49796	5651	192.168.2.4	101.99.91.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 15:18:03.620717049 CET	63416	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 25, 2024 15:17:52.482693911 CET	192.168.2.4	8.8.8.8	4d5a	Echo
Dec 25, 2024 15:17:52.605284929 CET	8.8.8.8	192.168.2.4	555a	Echo Reply
Dec 25, 2024 15:17:53.619966030 CET	192.168.2.4	8.8.8.8	4d59	Echo
Dec 25, 2024 15:17:53.742434025 CET	8.8.8.8	192.168.2.4	5559	Echo Reply
Dec 25, 2024 15:17:54.704425097 CET	192.168.2.4	8.8.8.8	4d58	Echo
Dec 25, 2024 15:17:54.826749086 CET	8.8.8.8	192.168.2.4	5558	Echo Reply
Dec 25, 2024 15:17:55.801295042 CET	192.168.2.4	8.8.8.8	4d57	Echo
Dec 25, 2024 15:17:55.923522949 CET	8.8.8.8	192.168.2.4	5557	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 15:18:03.620717049 CET	192.168.2.4	1.1.1.1	0x9eec	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 15:18:03.841295004 CET	1.1.1.1	192.168.2.4	0x9eec	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 25, 2024 15:18:36.227472067 CET	1.1.1.1	192.168.2.4	0x6da8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 25, 2024 15:18:36.227472067 CET	1.1.1.1	192.168.2.4	0x6da8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49797	101.99.91.150	80	8764	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 15:19:07.072685003 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 15:19:07.072702885 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49932	101.99.91.150	80	8764	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 15:20:07.056998014 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 15:20:07.057013988 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Target ID:	0
Start time:	09:17:50
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\0442.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0442.pdf.exe"
Imagebase:	0x7ff6414e0000
File size:	11'409'543 bytes
MD5 hash:	4F6B2B9EE57C50D6C505D0CDADA4803E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn
Imagebase:	0x7ff771210000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "
Imagebase:	0x7ff6dfbe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff771210000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:17:51
Start date:	25/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 8.8.8.8
Imagebase:	0x7ff7353b0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:17:53
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:17:53
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:17:53
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1720,i,4460427527233058691,5362964774260238234,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:17:59
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000000.1806255889.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:18:00
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000C.00000000.1812231802.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:18:02
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:18:02
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:18:04
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:18:04
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:18:04
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:18:07
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:18:07
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF64150B190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414E255C: GetDlgItem.USER32 ref: 00007FF6414E25AC
Part of subcall function 00007FF6414E255C: SetWindowTextW.USER32 ref: 00007FF6414E25C8

EndDialog.USER32 ref: 00007FF64150B2D0
SetDlgItemTextW.USER32 ref: 00007FF64150B320
GetMessageW.USER32 ref: 00007FF64150B350
IsDialogMessageW.USER32 ref: 00007FF64150B369
TranslateMessage.USER32 ref: 00007FF64150B37B
DispatchMessageW.USER32 ref: 00007FF64150B389
EndDialog.USER32 ref: 00007FF64150B3D3
GetDlgItem.USER32 ref: 00007FF64150B410
SendMessageW.USER32 ref: 00007FF64150B431
SendMessageW.USER32 ref: 00007FF64150B449
SetFocus.USER32 ref: 00007FF64150B452
GetLastError.KERNEL32 ref: 00007FF64150B634
GetLastError.KERNEL32 ref: 00007FF64150B665
GetTickCount.KERNEL32 ref: 00007FF64150B68B
GetLastError.KERNEL32 ref: 00007FF64150B6F5
GetCommandLineW.KERNEL32 ref: 00007FF64150B841
CreateFileMappingW.KERNEL32 ref: 00007FF64150B900
MapViewOfFile.KERNEL32 ref: 00007FF64150B923
Sleep.KERNEL32 ref: 00007FF64150B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF64150B9DF
CloseHandle.KERNEL32 ref: 00007FF64150B9E8
SetDlgItemTextW.USER32 ref: 00007FF64150BCDE
DialogBoxParamW.USER32 ref: 00007FF64150C0D7
EndDialog.USER32 ref: 00007FF64150C0EF
EnableWindow.USER32 ref: 00007FF64150C2A6
SendMessageW.USER32 ref: 00007FF64150C2F8
ShellExecuteExW.SHELL32 ref: 00007FF64150B95B

Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB67
Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB80

SendMessageW.USER32 ref: 00007FF64150BEC3
SendDlgItemMessageW.USER32 ref: 00007FF64150BEEA
GetDlgItem.USER32 ref: 00007FF64150BEF8
SendMessageW.USER32 ref: 00007FF64150BF12
GetDlgItem.USER32 ref: 00007FF64150BF4F
SetDlgItemTextW.USER32 ref: 00007FF64150BFEC
SetDlgItemTextW.USER32 ref: 00007FF64150C004
SetDlgItemTextW.USER32 ref: 00007FF64150C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150C381
SendDlgItemMessageW.USER32 ref: 00007FF64150C449
EndDialog.USER32 ref: 00007FF64150C463
GetDlgItem.USER32 ref: 00007FF64150C491
SetFocus.USER32 ref: 00007FF64150C49A
SendDlgItemMessageW.USER32 ref: 00007FF64150C53E
FindFirstFileW.KERNEL32 ref: 00007FF64150C562
FindClose.KERNEL32 ref: 00007FF64150C68A
SendDlgItemMessageW.USER32 ref: 00007FF64150C7AF

Part of subcall function 00007FF6414E129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414E1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150CAC7

Strings

@, xrefs: 00007FF64150B7B6
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF64150B799
runas, xrefs: 00007FF64150B7C9
REPLACEFILEDLG, xrefs: 00007FF64150C3D3
winrarsfxmappingfile.tmp, xrefs: 00007FF64150B8E0
p, xrefs: 00007FF64150B7AB
STARTDLG, xrefs: 00007FF64150B1CA
__tmp_rar_sfx_access_check_, xrefs: 00007FF64150B6A9
LICENSEDLG, xrefs: 00007FF64150C0C9
%s %s, xrefs: 00007FF64150C6D9, 00007FF64150C946

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 8b4b8352451f730ee2ea3e5c754e013c938db1b5af9506e8b4e96f0d2fe7a3ee
Instruction ID: 7b86862a149f8f1dcb26cda036c9f33aab1b48236f6de1a2e91f357388bb3dce
Opcode Fuzzy Hash: 8b4b8352451f730ee2ea3e5c754e013c938db1b5af9506e8b4e96f0d2fe7a3ee
Instruction Fuzzy Hash: 89D2B1A2A0D78241EB2AFB65E8903F96761EF86784F504131D9AD87AB5DF3CE644C700

Function 00007FF64150CE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF64150D5F3
SendMessageW.USER32 ref: 00007FF64150D626
SendMessageW.USER32 ref: 00007FF64150D655
MoveFileW.KERNEL32 ref: 00007FF64150DB4B
MoveFileExW.KERNEL32 ref: 00007FF64150DB69
GetTempPathW.KERNEL32 ref: 00007FF64150DC49

Part of subcall function 00007FF6414E1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1FFB

EndDialog.USER32 ref: 00007FF64150DFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64150EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64150EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64150EF73

Strings

<br>, xrefs: 00007FF64150D6DA, 00007FF64150D6E9
MIN, xrefs: 00007FF64150EAE5, 00007FF64150EAF4
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF64150D501
@set:user, xrefs: 00007FF64150DD96, 00007FF64150DDA5
MAX, xrefs: 00007FF64150EA82, 00007FF64150EA91
.tmp, xrefs: 00007FF64150DA85
ProgramFilesDir, xrefs: 00007FF64150D4F0
HIDE, xrefs: 00007FF64150E9E5, 00007FF64150E9F4
.lnk, xrefs: 00007FF64150E406, 00007FF64150E415
lnk, xrefs: 00007FF64150E3CA, 00007FF64150E3D9

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: fcd01dd56a1b0d9a94054e53721844b88349af29849e6bffae24d093a89b8920
Instruction ID: 70b29c7b9a1c255bd8cce1c892482717e2a150b5c3a65535b3b812886aac6219
Opcode Fuzzy Hash: fcd01dd56a1b0d9a94054e53721844b88349af29849e6bffae24d093a89b8920
Instruction Fuzzy Hash: B813A5B2B0CB8285EB16FFA4D8402EC2BB1EB41798F500535DA6D97AE9DF38D595C340

Function 00007FF641510754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6414FDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE018
Part of subcall function 00007FF6414FDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE030
Part of subcall function 00007FF6414FDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE05D

Part of subcall function 00007FF6414F62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6414F62F2
Part of subcall function 00007FF6414F62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6414F632C

Part of subcall function 00007FF64150946C: OleInitialize.OLE32 ref: 00007FF641509486
Part of subcall function 00007FF64150946C: SHGetMalloc.SHELL32 ref: 00007FF6415094D4

GetCommandLineW.KERNEL32 ref: 00007FF64151096E
OpenFileMappingW.KERNEL32 ref: 00007FF641510A07
MapViewOfFile.KERNEL32 ref: 00007FF641510A30
UnmapViewOfFile.KERNEL32 ref: 00007FF641510A46
MapViewOfFile.KERNEL32 ref: 00007FF641510A63
UnmapViewOfFile.KERNEL32 ref: 00007FF641510ACA
CloseHandle.KERNEL32 ref: 00007FF641510AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF641510BAD
GetLocalTime.KERNEL32 ref: 00007FF641510BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF641510C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF641510C26
GetModuleHandleW.KERNEL32 ref: 00007FF641510C2E
LoadIconW.USER32 ref: 00007FF641510C4D
DialogBoxParamW.USER32 ref: 00007FF641510CB6
Sleep.KERNEL32 ref: 00007FF641510CE6
DeleteObject.GDI32 ref: 00007FF641510D0D
DeleteObject.GDI32 ref: 00007FF641510D1F
CloseHandle.KERNEL32 ref: 00007FF641510D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641510DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641510DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641510DE3

Part of subcall function 00007FF64150FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF64150FD43
Part of subcall function 00007FF64150FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF64150FDBC

Strings

sfxstime, xrefs: 00007FF641510C1F
winrarsfxmappingfile.tmp, xrefs: 00007FF6415109F9
STARTDLG, xrefs: 00007FF641510CA5
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF641510C02
sfxname, xrefs: 00007FF641510B9B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction ID: a980f7295ca234852854220e4e0adeb61fbdadf37d2786ff12d752b12e64b554
Opcode Fuzzy Hash: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction Fuzzy Hash: DF127EA2E1CB8285EB1ABF24E8452F96761FF85784F504231DAAD87AB5DF3CE151C700

Function 00007FF6414FA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6414FA504

Part of subcall function 00007FF641500F68: WideCharToMultiByte.KERNEL32 ref: 00007FF641500F99

SetDlgItemTextW.USER32 ref: 00007FF6414FA573
GetWindowRect.USER32 ref: 00007FF6414FA5AD
GetClientRect.USER32 ref: 00007FF6414FA5BB
GetWindowLongPtrW.USER32 ref: 00007FF6414FA66C
GetWindowRect.USER32 ref: 00007FF6414FA6B2
SetWindowTextW.USER32 ref: 00007FF6414FA6EC
GetSystemMetrics.USER32 ref: 00007FF6414FA6F7
GetWindow.USER32 ref: 00007FF6414FA708
GetWindowRect.USER32 ref: 00007FF6414FA746
GetWindow.USER32 ref: 00007FF6414FA808

Strings

CAPTION, xrefs: 00007FF6414FA6CF
$%s:, xrefs: 00007FF6414FA4EF

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 43fc09f2f309da1afc25ed4d713dd9220d79cee1da31e274505c865b3860efb7
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 1F91F872B1C6418AE719FF29E8046A9B7A1FB84784F505535EE5D97BA8CF3CE805CB00

Function 00007FF641508624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF64150863D
SizeofResource.KERNEL32 ref: 00007FF641508659
LoadResource.KERNEL32 ref: 00007FF641508673
LockResource.KERNEL32 ref: 00007FF641508685
GlobalAlloc.KERNELBASE ref: 00007FF6415086A6
GlobalLock.KERNEL32 ref: 00007FF6415086BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF6415086E8
GdipAlloc.GDIPLUS ref: 00007FF6415086FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF641508769
GlobalUnlock.KERNEL32 ref: 00007FF64150878C
GlobalFree.KERNEL32 ref: 00007FF641508795

Strings

PNG, xrefs: 00007FF64150862F

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: c59a7b70d033906720e197640c8f9e98d57eed4e5ef025ea243e6f3b1dfb6477
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 534130A6A4DB0281EF1ABF96D4447F967A0AF89B94F140435CE2D87378EF7DE4588700

Function 00007FF6414EF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1263

Strings

__tmp_reference_source_, xrefs: 00007FF6414EFCCF, 00007FF6414EFCDE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction ID: 413224f1b4460e86557a67ca4b57e1e3bb5685ef6edc857ee308bedbf9c28459
Opcode Fuzzy Hash: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction Fuzzy Hash: FCE26F62A0C7C292EB66FB65E1403AE67A2FB81790F404132DBAD937A5CF3CE555C700

Function 00007FF6414E4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E5E1C

Strings

CMT, xrefs: 00007FF6414E59B2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: b72a447c2ddb22f05185b9639a81e7227c320d37a75114c120090eb22b33af98
Instruction ID: e9384678011ede3180670047fc498244faeb1c59f78cc11c356f95d179b74ac4
Opcode Fuzzy Hash: b72a447c2ddb22f05185b9639a81e7227c320d37a75114c120090eb22b33af98
Instruction Fuzzy Hash: EFE2EB62B0C78286EB1AFB64D5503FE67A2EB45394F440135DA6E8B7A6DF3CE255C300

Function 00007FF6414F40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6414F410B
FindFirstFileW.KERNEL32 ref: 00007FF6414F415E
GetLastError.KERNEL32 ref: 00007FF6414F41AF
FindNextFileW.KERNEL32 ref: 00007FF6414F41D7
GetLastError.KERNEL32 ref: 00007FF6414F41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F4315

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: d228e91e9c906b9614e3d0d1420745f5e92158cac7767d181f91d07df046f0e1
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: CB618162A0C64681EB16FB28E9442AD6362FB857B4F505331EABD877E9DF3CD544C700

Function 00007FF6414E5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6414E59B2, 00007FF6414E675B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction ID: abf595e3e32cb256a56f6eb8161ee9a139f332b67138b7b2ce03411d580953f2
Opcode Fuzzy Hash: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction Fuzzy Hash: 6642BB62B0C7829BEB5AFB74D1502FD67A2EB51348F400136DB6E97696DF38E658C300

Function 00007FF641501F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction ID: 3af4b01a9dbc81782e772e71c9efb04c897bcf14c4716737ebb5774236d4199b
Opcode Fuzzy Hash: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction Fuzzy Hash: 9EE1E3A2A0C2824AEB69FF69E0442ED7B91FB4674CF044135DB6E87666CF3CE5818704

Function 00007FF641503484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ae873f8167721f5f2066597c1632663bc2c9996c3b34b327fe22a5c50172c8
Instruction ID: 64680b5c194c531af50de4a91c463a8d30e910d5b30a5453d85a4ef4ec67db06
Opcode Fuzzy Hash: 42ae873f8167721f5f2066597c1632663bc2c9996c3b34b327fe22a5c50172c8
Instruction Fuzzy Hash: 23B1E1E2B08AC956DF9EEAA5D6086E96791B706BC8F488032DE2D47761DF3CE155C300

Function 00007FF6414F4928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction ID: ae6aa9c2fda4c175e26f557e1856129081fa33d33249a1211bb87ca7e4f45ce9
Opcode Fuzzy Hash: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction Fuzzy Hash: 78410722F19A9686FB69FF22F94176A2253FBC4788F085030DE6D87795DE3CE4468704

Function 00007FF6414FDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE05D
CreateFileW.KERNEL32 ref: 00007FF6414FE3F0
SetFilePointer.KERNEL32 ref: 00007FF6414FE40E
ReadFile.KERNEL32 ref: 00007FF6414FE436

Part of subcall function 00007FF6414FDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6414FDDDF

CompareStringW.KERNELBASE ref: 00007FF6414FE559
CloseHandle.KERNEL32 ref: 00007FF6414FE4F3

Part of subcall function 00007FF6414E1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1FFB

Part of subcall function 00007FF6414F51A4: GetVersionExW.KERNEL32 ref: 00007FF6414F51D5

Part of subcall function 00007FF6414FDFD0: LoadLibraryExW.KERNELBASE ref: 00007FF6414FDEFF
Part of subcall function 00007FF6414FDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FDFB5
Part of subcall function 00007FF6414FDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FDFBB
Part of subcall function 00007FF6414FDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FDFC1
Part of subcall function 00007FF6414FDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6414FE7AA
ExitProcess.KERNEL32 ref: 00007FF6414FE7BB

Strings

peerdist.dll, xrefs: 00007FF6414FE38D
dhcpcsvc.dll, xrefs: 00007FF6414FE32B
DXGIDebug.dll, xrefs: 00007FF6414FE086, 00007FF6414FE5B6
crypt32.dll, xrefs: 00007FF6414FE187
dsrole.dll, xrefs: 00007FF6414FE37F
devrtl.dll, xrefs: 00007FF6414FE29F
atl.dll, xrefs: 00007FF6414FE136
XmlLite.dll, xrefs: 00007FF6414FE339
UXTheme.dll, xrefs: 00007FF6414FE0B2
srvcli.dll, xrefs: 00007FF6414FE221
RpcRtRemote.dll, xrefs: 00007FF6414FE363
rsaenh.dll, xrefs: 00007FF6414FE0A7
ieframe.dll, xrefs: 00007FF6414FE120
mlang.dll, xrefs: 00007FF6414FE2BB
propsys.dll, xrefs: 00007FF6414FE2AD
setupapi.dll, xrefs: 00007FF6414FE141
cryptsp.dll, xrefs: 00007FF6414FE355
WINNSI.DLL, xrefs: 00007FF6414FE275
SetDllDirectoryW, xrefs: 00007FF6414FE026
dhcpcsvc6.dll, xrefs: 00007FF6414FE31D
wintrust.dll, xrefs: 00007FF6414FE1B1
dwmapi.dll, xrefs: 00007FF6414FE0BD, 00007FF6414FE661
cabinet.dll, xrefs: 00007FF6414FE1DB
oleaccrc.dll, xrefs: 00007FF6414FE1E9
ntshrui.dll, xrefs: 00007FF6414FE12B
ntmarta.dll, xrefs: 00007FF6414FE1F7
profapi.dll, xrefs: 00007FF6414FE205
cryptui.dll, xrefs: 00007FF6414FE1A3
usp10.dll, xrefs: 00007FF6414FE0DE
shell32.dll, xrefs: 00007FF6414FE1BF
msasn1.dll, xrefs: 00007FF6414FE195
netutils.dll, xrefs: 00007FF6414FE283
ws2_32.dll, xrefs: 00007FF6414FE0FF
secur32.dll, xrefs: 00007FF6414FE1CD
psapi.dll, xrefs: 00007FF6414FE115
comres.dll, xrefs: 00007FF6414FE0F4
lpk.dll, xrefs: 00007FF6414FE0D3
dfscli.dll, xrefs: 00007FF6414FE2F3
clbcatq.dll, xrefs: 00007FF6414FE0E9
sfc_os.dll, xrefs: 00007FF6414FE091
linkinfo.dll, xrefs: 00007FF6414FE347
netapi32.dll, xrefs: 00007FF6414FE16B
ws2help.dll, xrefs: 00007FF6414FE10A
apphelp.dll, xrefs: 00007FF6414FE14F
mpr.dll, xrefs: 00007FF6414FE291
aclui.dll, xrefs: 00007FF6414FE371
uxtheme.dll, xrefs: 00007FF6414FE66D
SetDefaultDllDirectories, xrefs: 00007FF6414FE053
dnsapi.DLL, xrefs: 00007FF6414FE259
SSPICLI.DLL, xrefs: 00007FF6414FE09C
slc.dll, xrefs: 00007FF6414FE23D
rasadhlp.dll, xrefs: 00007FF6414FE30F
iphlpapi.DLL, xrefs: 00007FF6414FE267
cryptbase.dll, xrefs: 00007FF6414FE0C8
samcli.dll, xrefs: 00007FF6414FE2C9
shdocvw.dll, xrefs: 00007FF6414FE179
version.dll, xrefs: 00007FF6414FE07B
samlib.dll, xrefs: 00007FF6414FE2D7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6414FE73B
cscapi.dll, xrefs: 00007FF6414FE22F
WindowsCodecs.dll, xrefs: 00007FF6414FE213
userenv.dll, xrefs: 00007FF6414FE15D
browcli.dll, xrefs: 00007FF6414FE301
wkscli.dll, xrefs: 00007FF6414FE2E5
imageres.dll, xrefs: 00007FF6414FE24B
kernel32, xrefs: 00007FF6414FE011

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction ID: a49c8dc089cc56a058590f54fbafb4ea9976f42f7de964c80dd410d32e3da09d
Opcode Fuzzy Hash: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction Fuzzy Hash: DD323A72A0DB9299EB26BF60E8402E933A5FF44354F500236DA6D977A5EF3CE245C740

Function 00007FF6414F98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414F8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6414F9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414FA435

Part of subcall function 00007FF641500BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF641500B44), ref: 00007FF641500BE9

Strings

, xrefs: 00007FF6414F9DF9
STRINGS, xrefs: 00007FF6414F9DC1
MENU, xrefs: 00007FF6414F9DD9
DIRECTION, xrefs: 00007FF6414F9DE5
DIALOG, xrefs: 00007FF6414F9DCD
,, xrefs: 00007FF6414F9FAA
$%s:, xrefs: 00007FF6414F9F50
@%s:, xrefs: 00007FF6414F9F57
*messages***, xrefs: 00007FF6414F9BC6
*messages***, xrefs: 00007FF6414F9C04
RTL, xrefs: 00007FF6414F9F2E

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction ID: db16696a7fae35f12cf0011506c0329baa1c72c73c72b65ed7ae885da0b27b61
Opcode Fuzzy Hash: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction Fuzzy Hash: 51628A62A1DA9285EB12FF64D4442EE37A6FB40788F904132EA6D877E5EF3CE545C340

Function 00007FF641511900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF641511558: DloadProtectSection.DELAYIMP ref: 00007FF6415115C9

RaiseException.KERNEL32 ref: 00007FF6415119A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF641511993

Part of subcall function 00007FF641511868: DloadProtectSection.DELAYIMP ref: 00007FF6415118C7

LoadLibraryExA.KERNELBASE ref: 00007FF641511A46
GetLastError.KERNEL32 ref: 00007FF641511A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF641511A86
RaiseException.KERNEL32 ref: 00007FF641511A9A

Strings

H, xrefs: 00007FF641511974

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: b406d440489c209ffbf4b1d6518587d94626b2988ef98e5c39e1044794df3110
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 2F914BA2F09B518AEB0AFFA5D8846EC37A1BB08B98F044435DE2D57765EF38E445C740

Function 00007FF64150F4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF64150F747
ShowWindow.USER32 ref: 00007FF64150F786
GetExitCodeProcess.KERNEL32 ref: 00007FF64150F7BD
CloseHandle.KERNEL32 ref: 00007FF64150F7E7
ShowWindow.USER32 ref: 00007FF64150F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150F8FB

Strings

.exe, xrefs: 00007FF64150F7F2
.inf, xrefs: 00007FF64150F675
p, xrefs: 00007FF64150F529
Install, xrefs: 00007FF64150F684

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction ID: 61344eb226e430876021043c06078a046eb9b6618af4333bbbbecb618d59e7a9
Opcode Fuzzy Hash: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction Fuzzy Hash: D7C174A2F1C60296FB1AFB65D9502FD2B61AF86788F048032DA5DC76B5DF3CE5558300

Function 00007FF64150F0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64150AE1C: PeekMessageW.USER32 ref: 00007FF64150AE32
Part of subcall function 00007FF64150AE1C: GetMessageW.USER32 ref: 00007FF64150AE49
Part of subcall function 00007FF64150AE1C: IsDialogMessageW.USER32 ref: 00007FF64150AE60
Part of subcall function 00007FF64150AE1C: TranslateMessage.USER32 ref: 00007FF64150AE6F
Part of subcall function 00007FF64150AE1C: DispatchMessageW.USER32 ref: 00007FF64150AE7A

GetDlgItem.USER32 ref: 00007FF64150F0E3
ShowWindow.USER32 ref: 00007FF64150F109
SendMessageW.USER32 ref: 00007FF64150F11E
SendMessageW.USER32 ref: 00007FF64150F136
SendMessageW.USER32 ref: 00007FF64150F157
SendMessageW.USER32 ref: 00007FF64150F173
SendMessageW.USER32 ref: 00007FF64150F1B6
SendMessageW.USER32 ref: 00007FF64150F1D4
SendMessageW.USER32 ref: 00007FF64150F1E8
SendMessageW.USER32 ref: 00007FF64150F212
SendMessageW.USER32 ref: 00007FF64150F22A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: ab45ae276a9dd1862b6c3e79049da3767ceffc5d92bfce49b9aa4fb3d93b51e5
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: F841E3B1B1864286F70AFF61EC00BEA2760EB86B88F440135DD2E87BA4CF3DE4558744

Function 00007FF6414EEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF572

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction ID: 90c6b5697e7a6caf51bfdbdda9d3134f078b69f895586c530a17c1e01c7e4fb9
Opcode Fuzzy Hash: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction Fuzzy Hash: 3D12B362F0CB4185EB12FB65D4442ED2772EB457A8F500232DA6D97AEADF3CD685C340

Function 00007FF6414F24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6414F259B
GetLastError.KERNEL32 ref: 00007FF6414F25AE
CreateFileW.KERNEL32 ref: 00007FF6414F260E
GetLastError.KERNEL32 ref: 00007FF6414F2617
SetFileTime.KERNEL32 ref: 00007FF6414F26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F2736

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: 1a0d5d68514dcd536b310b35e9d0c92bf131ae90a87585b7e46715b05e9e8ad1
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: 2361D2A2A1C68185F725AB29E4047AE67A2FB857A8F101334DEBD43BE4DF3DD0558704

Function 00007FF64150B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF64150B02A
GetObjectW.GDI32 ref: 00007FF64150B05B
DeleteObject.GDI32 ref: 00007FF64150B095
DeleteObject.GDI32 ref: 00007FF64150B0C5

Part of subcall function 00007FF641508624: FindResourceW.KERNEL32 ref: 00007FF64150863D
Part of subcall function 00007FF641508624: SizeofResource.KERNEL32 ref: 00007FF641508659
Part of subcall function 00007FF641508624: LoadResource.KERNEL32 ref: 00007FF641508673
Part of subcall function 00007FF641508624: LockResource.KERNEL32 ref: 00007FF641508685
Part of subcall function 00007FF641508624: GlobalAlloc.KERNELBASE ref: 00007FF6415086A6
Part of subcall function 00007FF641508624: GlobalLock.KERNEL32 ref: 00007FF6415086BB
Part of subcall function 00007FF641508624: CreateStreamOnHGlobal.COMBASE ref: 00007FF6415086E8
Part of subcall function 00007FF641508624: GdipAlloc.GDIPLUS ref: 00007FF6415086FE
Part of subcall function 00007FF641508624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF641508769
Part of subcall function 00007FF641508624: GlobalUnlock.KERNEL32 ref: 00007FF64150878C
Part of subcall function 00007FF641508624: GlobalFree.KERNEL32 ref: 00007FF641508795

Strings

], xrefs: 00007FF64150B063

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 00b5bd2abd95ffd684df83966ef0bca24ddd0db2ae972141a30ca2ea04685358
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 9F11D6A5F0D64241FB2AFB5196543F95791AF89BC8F080034D93D87BA9DE3CE8048604

Function 00007FF64150AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF64150AE32
GetMessageW.USER32 ref: 00007FF64150AE49
IsDialogMessageW.USER32 ref: 00007FF64150AE60
TranslateMessage.USER32 ref: 00007FF64150AE6F
DispatchMessageW.USER32 ref: 00007FF64150AE7A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 0249a7a0db2c33ec71235a6fb8ab905de417229f572dbfd77ba652c3f7f886ef
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 64F0ECA6B3C94282FB59BB64E995BB62361FFD0745F806431E55EC1864DF3CD518CB00

Function 00007FF6415091E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF641509211
SHAutoComplete.SHLWAPI ref: 00007FF641509255

Part of subcall function 00007FF6415013C4: CompareStringW.KERNEL32 ref: 00007FF6415013E3

FindWindowExW.USER32 ref: 00007FF64150923F

Strings

EDIT, xrefs: 00007FF64150921B, 00007FF641509233

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 858dce1837389f16e36a5de32caf747e986a64c6edae27e7e96187c9cf88008c
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 00016DA1B1CA4381FB2ABB61A8103F66390AF99744F441031CD6DC6A78DE3CE1498B40

Function 00007FF6414F2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6414F8C9A), ref: 00007FF6414F2D22
WriteFile.KERNEL32 ref: 00007FF6414F2D6C
WriteFile.KERNELBASE ref: 00007FF6414F2D9A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: 8c505a63cf7955f38aa463a4faf43104036d5910fac18fb7916f98b7201c707a
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: 1F51D362B1D64292EB16FB25D444BBA2351FB84B90F540131EA6D87BE4DF3CE485C700

Function 00007FF6415103E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF641510556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415105C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415105C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415105CD

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction ID: 4d8c49ab491d400d36e1ce6658ddd365c01f63a71b45bf387194b39d8967c17b
Opcode Fuzzy Hash: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction Fuzzy Hash: B551AFA2F1866284FB0ABFA5D8442ED2762AF44BA4F500631DA3C97BE9DF6CD440C300

Function 00007FF6414F3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF6414F309D), ref: 00007FF6414F36CE
CreateDirectoryW.KERNEL32 ref: 00007FF6414F3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6414F309D), ref: 00007FF6414F3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F37CE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 8583afb856932682461eae8dc437c61803fb52622310eeb81758d90101a090b6
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: 6231F562A0C68281EB22BB25A6442BD6393FF887A0F544231EEADC37E4DF3CD445C700

Function 00007FF641512D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF641512D7B

Part of subcall function 00007FF6415127FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF64151281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF641512D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF641512DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF641512E51

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 00ef615091d97af66d6dd46cfbe3a9d72e5c98b6022360350b89d18dd86ae7f7
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: A43159A5E4C20346FB5FBFA4A4113FA2B91AF41384F540434EA6ECB6F7DE6DA8058340

Function 00007FF6414F2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6414F2927,?,00100000,?,00000001,00000000,00000000,?,00007FF6414F14C1), ref: 00007FF6414F2348
ReadFile.KERNELBASE ref: 00007FF6414F2367
GetLastError.KERNEL32 ref: 00007FF6414F239B
GetLastError.KERNEL32 ref: 00007FF6414F23BA

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: cd30d8cbf51bf16724a65076143f14eb422800608d5d3e235cce72654987c3e8
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 3021A462E0C55281EB61BF31A40067D63A2FB45B94F144530DA7DCAF94DF7CD8858B11

Function 00007FF6414FE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414FECD8: ResetEvent.KERNEL32 ref: 00007FF6414FECF1
Part of subcall function 00007FF6414FECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF6414FED07

ReleaseSemaphore.KERNEL32 ref: 00007FF6414FE974
CloseHandle.KERNELBASE ref: 00007FF6414FE993
DeleteCriticalSection.KERNEL32 ref: 00007FF6414FE9AA
CloseHandle.KERNEL32 ref: 00007FF6414FE9B7

Part of subcall function 00007FF6414FEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6414FE95F,?,?,?,00007FF6414F463A,?,?,?), ref: 00007FF6414FEA63
Part of subcall function 00007FF6414FEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6414FE95F,?,?,?,00007FF6414F463A,?,?,?), ref: 00007FF6414FEA6E

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 1366eb80ff213ff65391554c1922f8ecaeb354cf7b10aa2452f23b8d7047c77e
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 63012D33A18A8192E749FB21E5446ADA361FB84B80F004031DB6D53665CF39E5B58B44

Function 00007FF6414FEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6414FEAE0
SetThreadPriority.KERNEL32 ref: 00007FF6414FEB36

Strings

CreateThread failed, xrefs: 00007FF6414FEAEE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 3f8dbf5d7b01ea700d510fea39ed106c637d3569bb648402b833bcd2ceb0bc13
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 92118F72A0CB4291EB06FB10E8412EA7361FB84785F544531EA6D83779DF3CE695CB40

Function 00007FF64150946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414FDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6414FDDDF

OleInitialize.OLE32 ref: 00007FF641509486
SHGetMalloc.SHELL32 ref: 00007FF6415094D4

Strings

riched20.dll, xrefs: 00007FF641509475

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 9267e3f268d207d55dfdc1caf067706e8e18faa364629f8a3660a5d6d5911b14
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: CEF0FFB1A1CA8182EB56BF60F4552EAB7A0FB88754F440135E99D82B64DF7CE159CB00

Function 00007FF64150095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64150853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF64150856C

Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB67
Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB80

Part of subcall function 00007FF6414E1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1FFB

Part of subcall function 00007FF6414E129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414E1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415101BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415101C1
SendDlgItemMessageW.USER32 ref: 00007FF6415101F2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction ID: 54a0959faa35c6f8e7b68a58e76c541c4e207c0be69f0153e99d4e8c894159ec
Opcode Fuzzy Hash: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction Fuzzy Hash: E851B3A2F5C74286FB16BBA5D8512FD2362AB89BC8F500136DE2D977E6DE2CD504C340

Function 00007FF6414F2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6414F21CF
CreateFileW.KERNEL32 ref: 00007FF6414F223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F22D8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: 04342dbaa78208d15c04da5b7fe6aa98bff881075da745621d374a5b008c3764
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: 3A41A066A0C78282EB25AB15E4446A967A2FB84BB4F105334DFBD43BD5CF3CE4908704

Function 00007FF6414E23F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6414E243E
GetWindowTextW.USER32 ref: 00007FF6414E2476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E2505

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: bbf953cf685b3f7b415499818520e223d7112f4bfdab5bdcac3f3eeab1d51371
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: 6221A2A2A1CB8181EB15FB65B9405BAA365FB89BD0F144235EBDD43BA5CF3CD190C700

Function 00007FF641501F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF64150205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF641502077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF641502093

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction ID: cfa6d24e2f64e2a478280575a80177176def8eae88c332f8ce7ed089a2f82624
Opcode Fuzzy Hash: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction Fuzzy Hash: 2A31D492A0C68651FB2AFB50E4443F967A0FB51788F044031D6AC869B5DF7CE646C302

Function 00007FF6414F3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6415007E1), ref: 00007FF6414F3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF6414F3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F3E1A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: 7382ca9f750a30cd44bd4d121f0895f7b34378a1957a9342bcf2a8fbdf256611
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: D221B863B1C68541EB26BF25E4452A96362FF88794F105230EAAD837E5DF3CD545CB00

Function 00007FF6414F31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF641500822), ref: 00007FF6414F31E7
DeleteFileW.KERNEL32 ref: 00007FF6414F3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F32A1

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: 9fa06b63e1f3a9e98633380fb4837f74c45b45cdbe05160d3a755fa85a5c4615
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: B821C862A1C78181EF11BB25F4452AE7361FF88B94F501231EAAE83BA5DF3CD144CB00

Function 00007FF6414F32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6414FE5B1,?,?,?,00000000,?), ref: 00007FF6414F32E7
GetFileAttributesW.KERNELBASE ref: 00007FF6414F3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F3399

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: fab82215d16d689e6342f0d01037bda883731fbf53dd138ed587e4495d472039
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: 84216062A1C68181EB15FB29F44516963A2FB89BA4F500231EAAD83BA9DF3CD541CB04

Function 00007FF64151BF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF64151BF48), ref: 00007FF64151BF8C
TerminateProcess.KERNEL32(?,?,?,00007FF64151BF48), ref: 00007FF64151BF97
ExitProcess.KERNEL32 ref: 00007FF64151BFA6

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 7037b27cb68ad5cd2dd554737ec71260c9d0fc3abd438845f089f0a829ddec4c
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: E3E01AA5E0C30546EB5A7F7198957F927A26F88B41F144438D82A863B6CE3EA4098A00

Function 00007FF6414EF578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EF89B

Part of subcall function 00007FF6414F3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF641500811), ref: 00007FF6414F3EFD

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 31de71ccb13629eb4e8ff473cf0e989b9a8a473b909947ada8621b483159802c
Instruction ID: 3173aa5801c190af8b576114cb1bb8428cac5824d884f103ca92f41b2664ac38
Opcode Fuzzy Hash: 31de71ccb13629eb4e8ff473cf0e989b9a8a473b909947ada8621b483159802c
Instruction Fuzzy Hash: 3191AF73A1CB9190EB12FF64D4402ED6761FB84798F904136EA5C87AE9DF78D685C310

Function 00007FF6414E3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E3AB9

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction ID: 841a8ee39664137a9140808014c62b66a451eda2ce34fa30bbaf03f3b7046b4b
Opcode Fuzzy Hash: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction Fuzzy Hash: 5241DE62F1C75284FB06FBB5D4402ED2721AF44BD8F141235EE2DA7A9ACF38E5828300

Function 00007FF6414F2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6414F274D), ref: 00007FF6414F28A9
GetLastError.KERNEL32(?,00007FF6414F274D), ref: 00007FF6414F28B8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: e9867ccd8c99c661df0e3fa466848096027860d3ad36cfd08f3739b177f109b0
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: BB31B862B1D95282EB66BB2AD540AB52391EF04BD4F140231EE2D87FA0DF3CE9418740

Function 00007FF6414E22BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6414E22F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E23F0

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: 1e8c79abd76329e8c45034463879bd9b84c838c04017f4f2ec95d6c3425338b6
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: 2E31CF62A1C78582EB16FF25F4453BEB361EB84B90F404231EAAC47BA5DF3CE1408B04

Function 00007FF6414F2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6414F2AFE
SetFileTime.KERNELBASE ref: 00007FF6414F2B9B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 0be5d4e7d1212468958b30827047c564576a5fca3a31f3f47343dacdc58133db
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 6121E062F0DB4A61EB67BF51D414BBA5792AF01794F154031DF5C42BA5EE3CD586C300

Function 00007FF6414FAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6414FAB67
LoadStringW.USER32 ref: 00007FF6414FAB80

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: eff161db8f7b10f266fe2a228454af4326df86988e97cf7dfc76e832e8371aeb
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: E5118BB1B0C61186EB0ABF16E8402A877A2BB88FC0BA44835CE2DD3731DF7CE5518344

Function 00007FF6414F2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6414F2C11
GetLastError.KERNEL32 ref: 00007FF6414F2C1E

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 20d2a2180b9f20ee711a120d2e3748e72d03bf6bb210c7ac135863aba2ff48ab
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 1511B131A0CA8281EB62BB65E8417B96361FB44BB4F540331DA7D86BE5CF3CD992C700

Function 00007FF6414E255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414FA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6414FA504
Part of subcall function 00007FF6414FA4AC: SetDlgItemTextW.USER32 ref: 00007FF6414FA573
Part of subcall function 00007FF6414FA4AC: GetWindowRect.USER32 ref: 00007FF6414FA5AD
Part of subcall function 00007FF6414FA4AC: GetClientRect.USER32 ref: 00007FF6414FA5BB

GetDlgItem.USER32 ref: 00007FF6414E25AC
SetWindowTextW.USER32 ref: 00007FF6414E25C8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: cfb83d7e5f41b621da9e4e7bae33fbdadbc27231eb13abe2f57896d5e308dd95
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 7F017160B0D34A41FF5BB752A6587BA5391AF85748F084034C85E877EADF3CE984C300

Function 00007FF6414FEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6414FEBAD,?,?,?,?,00007FF6414F5752,?,?,?,00007FF6414F56DE), ref: 00007FF6414FEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF6414FEB6F

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 01de149d81d1feaf1cf082478e9d64dfb36679bc0e876542d6d297be52fd8459
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: BEE06561B1854A46DB5AAB55C4515E963D2BF88B40B848035D61BC3618DE2CE6458B00

Function 00007FF6415121D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF641512200

Part of subcall function 00007FF641512F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF641512F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF641512206

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: 57419cfbf5e134f4e0f83da335dda88fff231adc37a2593ba51460a4aa51fd2d
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: 8CE012C5E4D10B45FF2FBA7128261F80A501F69770E3C1B30DE3EC46F2AE1CA5958250

Function 00007FF64151D90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF64151D922
GetLastError.KERNEL32 ref: 00007FF64151D934

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 51ef4a4a221726c558069ec27470f7dc9edccf150e57375d232b6a114e82d6b6
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: D0E0B6E1E4D50346FF1FBFF298492F82AD25F98B55B044434C92DCA272EF2CA8958A00

Function 00007FF6414E33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E388C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: db0f75601c8d953953658c1d14be6529ec917dbd1ad2d5887d518296e9f1c024
Instruction ID: 46c37a19dbc512ac4c5503f4fd4d3cde92f4c10fcbbf47cf34ecbe011ba35db7
Opcode Fuzzy Hash: db0f75601c8d953953658c1d14be6529ec917dbd1ad2d5887d518296e9f1c024
Instruction Fuzzy Hash: E7D16EB2B0C78256EB6BFB2596442B97BA1FF05B84F044435CA5D877A5CF3CE6618B00

Function 00007FF6414F5294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F551B

Part of subcall function 00007FF6415013F4: CompareStringW.KERNEL32 ref: 00007FF64150145A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction ID: 2058e8602bcf797aa7cb0ad11e9928ff6f1158c6968282c86debd7e292a29c61
Opcode Fuzzy Hash: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction Fuzzy Hash: 6B610071F0C24781FB6BBA2988042BA5693AF41BD4F144131EE6DCBBD6EE7CE4418308

Function 00007FF641501870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414FE948: ReleaseSemaphore.KERNEL32 ref: 00007FF6414FE974
Part of subcall function 00007FF6414FE948: CloseHandle.KERNELBASE ref: 00007FF6414FE993
Part of subcall function 00007FF6414FE948: DeleteCriticalSection.KERNEL32 ref: 00007FF6414FE9AA
Part of subcall function 00007FF6414FE948: CloseHandle.KERNEL32 ref: 00007FF6414FE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641501ACB

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction ID: 5eb99534a0ec18d871f7b209097cf7a087f50081a89a2b96a9139bc9d2383363
Opcode Fuzzy Hash: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction Fuzzy Hash: A461BFA2B1968592EF0EFFA5D1840FC7765FB41B94B544232E73D87AE1CF28E4A08300

Function 00007FF6414EEC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EEEB8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction ID: 4d9681b81b1185d950ed18c41eb5c86699c345b828a4dc37d075950def29e347
Opcode Fuzzy Hash: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction Fuzzy Hash: 2E51CDA2A0C78290EB16FB29E4443A92752FB85BD4F440132EF5D977A6DF3DE685C340

Function 00007FF6414EE7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF641500811), ref: 00007FF6414F3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EE993

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: 0a9ad7ee182b9b304fa6cd0171924f775e1ba548f9e4a0859b020e595a050349
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: 47516C62B0C78681FB62FF65E4453AD23A1FF84B84F540236EA9D976A6CF2CD641C710

Function 00007FF6414F1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F187D

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9385cba53fa6208ca460e05f3a710e61ac95cb77221bf3bd1eb05f532c4ae120
Instruction ID: 8a9aabe5ddfcde80bfa33bf49349099902dedddda1be561de6b8e437ac00f131
Opcode Fuzzy Hash: 9385cba53fa6208ca460e05f3a710e61ac95cb77221bf3bd1eb05f532c4ae120
Instruction Fuzzy Hash: B241F762F1CB8142EB16BA17AA0037AA652FB44FC0F448535EE6D8BF5ADF3CD4518340

Function 00007FF6414F2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F30C8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction ID: 8ad64c9cd81d12e6cd9fb14c009935b34a75c02cb05c1a815dbf9250c3475755
Opcode Fuzzy Hash: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction Fuzzy Hash: 6A41F4A2A1CB0580EF16BF29E64537923A2EB84BD8F141135EA6D877ADDF3DE440C700

Function 00007FF64151BDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF64151BE20

Part of subcall function 00007FF64151BFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF64151BFD0
Part of subcall function 00007FF64151BFB0: GetProcAddress.KERNEL32 ref: 00007FF64151BFE6
Part of subcall function 00007FF64151BFB0: FreeLibrary.KERNEL32 ref: 00007FF64151C00B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 4cb3131cb2b4bf266a644c9ef816cb56ce3ed61b78fe6abaa4b1d092e49969d3
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: AC41C0A2E1D64286FB2FBF5498502F82AB1AF54B40F484536DA2DC76B1CF3DE841C740

Function 00007FF6414E129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414E1396

Part of subcall function 00007FF6414E1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6414E1F89

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: ae4aa31824b7da0d77a8f4b9fb7a8218d847e075a5624bc92285f3cd7a959bae
Instruction ID: 943bc3df16e00922fe01510ab70f10d9bd3348cea8ab1510d1059338964053c7
Opcode Fuzzy Hash: ae4aa31824b7da0d77a8f4b9fb7a8218d847e075a5624bc92285f3cd7a959bae
Instruction Fuzzy Hash: C221AC62A4C75185EB16FF92A4002B96650AB04FF0F680B30DE7E8BBD1DF7CE6918340

Function 00007FF64152124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF641521280

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 3e8a6b5526c9cf00f3ae27fe4ed67eb9274d8f8e0539522d312f70fda186baad
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 9F118EF2D0C68286F71ABF91A4802FA76A4FB45380F550135FAADC76A9DF3CE4108B04

Function 00007FF64150FC68 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64150F0A4: GetDlgItem.USER32 ref: 00007FF64150F0E3
Part of subcall function 00007FF64150F0A4: ShowWindow.USER32 ref: 00007FF64150F109
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F11E
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F136
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F157
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F173
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F1B6
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F1D4
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F1E8
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F212
Part of subcall function 00007FF64150F0A4: SendMessageW.USER32 ref: 00007FF64150F22A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150FD03

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: MessageSend$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1587882848-0
Opcode ID: 98356bcfc0f9eb0b54ad4562f3e8dfcdedede25df190cb48db04b7e24fbe0ebe
Instruction ID: d2a8525b32a2f4bc52653d83944cf74ed620e7ed3782b89d00d1ec96be7fb4b3
Opcode Fuzzy Hash: 98356bcfc0f9eb0b54ad4562f3e8dfcdedede25df190cb48db04b7e24fbe0ebe
Instruction Fuzzy Hash: 5401CCD2E1C68542EB16BB64D4463FD6711FFC9794F504331EABD866E5DF2CD1408604

Function 00007FF6414E3AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E3B6C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: 792c0fde2304c43421769c89f2b197d97100fbed9377d669be38972af772a78a
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: 3801C4A2E1C78545EF17FB28E4412AD7362FF89790F505231E6AD47BA6DF2CD1408704

Function 00007FF641511558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF641511604: GetModuleHandleW.KERNEL32(?,?,?,00007FF641511573,?,?,?,00007FF64151192A), ref: 00007FF64151162B

DloadProtectSection.DELAYIMP ref: 00007FF6415115C9

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: c1268b9b29ec020ca08aa7a9cb809213904f3e160d80251caa0a63a3aa6be32a
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: 2111BEE1E4C50751FB5FBFA5A8803F02790AF14748F140474C92DC63B6EF3CA4A59A40

Function 00007FF6414F3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F40BC: FindFirstFileW.KERNELBASE ref: 00007FF6414F410B
Part of subcall function 00007FF6414F40BC: FindFirstFileW.KERNEL32 ref: 00007FF6414F415E
Part of subcall function 00007FF6414F40BC: GetLastError.KERNEL32 ref: 00007FF6414F41AF

FindClose.KERNELBASE(?,?,00000000,00007FF641500811), ref: 00007FF6414F3EFD

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: ee95db502b2a827ef72b64c9702feea78409dd2cb28bdd6f4f9387ca823e010b
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 2DF0A46290C24185DB11FB75A2001B93761DB15BB4F141374EA7D473C7CE2CD444C755

Function 00007FF6414F273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6414F2755

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: 2cc007a89fb7c710b6af87a0f6a90430b2aa8da717082c422324a8f9a4ca4048
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: 87E0C252B2851582EF25BB7AC842AB813A1EF8CF84B481030CE1C87731CF2CD4818B00

Function 00007FF6414F2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6414F24A2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: a01166820b38cfac6b722e0c0cd89c67b9309f36afe5b03b448b019fa3edbcfa
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 3BD02212D0D80082DF00B7359C4107C2360AF82338FA00330C23EC1BE1CE1CD086AB01

Function 00007FF6414F7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6414F7FD2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 5c4431739dececfd56b1f95e6433bd4d03ebe2ffd9161a569003bbe196fd617f
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 81C08C21F09502C1DB087B26C8C905813A5BB50B05B708034C11CC1230CE2CC5EA9749

Function 00007FF64151FA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF64151FA59

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 6eabfd70805218b8be651dbcc1aa6fdbe63d1da3f147e9064ca1e31a1cc23720
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 4BF049D2F0D2074AFF5FBF6199113F41A905F89B90F0C5432C92ECA3A1EE6CA6898210

Function 00007FF64151D94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF64151D98A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 6c70dd6b537610ef385d4716ca6d26b6c446c0f14118a2c4f1d3e64f3377a8fd
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 1AF0D491F0D24645FF6F7FA158592F92A925F887A0F085A30D97EC62E1DE2CA4808610

Function 00007FF6414F20D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6414F207E), ref: 00007FF6414F20F6

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 13e36b74ad1976b903104aa956edc4534966a954ae733ca13d3c409ae96dbcaf
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 4EF0C226A0C68295FB26FB30E1417B92762EB14B78F584334D73D816D4CF28D895C708

Non-executed Functions

Function 00007FF6414EC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414EDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6414ECF4B), ref: 00007FF6414EDE27
Part of subcall function 00007FF6414EDE04: GetLastError.KERNEL32 ref: 00007FF6414EDE88
Part of subcall function 00007FF6414EDE04: CloseHandle.KERNEL32 ref: 00007FF6414EDE9B

wcscpy.LIBCMT ref: 00007FF6414ECBC8
wcscpy.LIBCMT ref: 00007FF6414ECBFE
CreateFileW.KERNEL32 ref: 00007FF6414ECC38
DeviceIoControl.KERNEL32 ref: 00007FF6414ECD01
CloseHandle.KERNEL32 ref: 00007FF6414ECD12
GetLastError.KERNEL32 ref: 00007FF6414ECD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF6414ECD7D
DeleteFileW.KERNEL32 ref: 00007FF6414ECD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ECED7

Strings

UNC\, xrefs: 00007FF6414EC53F, 00007FF6414EC55D
SeRestorePrivilege, xrefs: 00007FF6414EC343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6414EC34F
\??\, xrefs: 00007FF6414EC392, 00007FF6414EC3B8

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction ID: 08fc3d66d602974f6e3fd2574e56cac080733fb5836f1771393c80aa9508bdb5
Opcode Fuzzy Hash: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction Fuzzy Hash: 0E628EA2F1C74285FB06FBB4D4442ED2761AB857A4F504231DA6D97AEADF3CE685C300

Function 00007FF6414FF180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF641500528

Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB67
Part of subcall function 00007FF6414FAAE0: LoadStringW.USER32 ref: 00007FF6414FAB80

Part of subcall function 00007FF64150B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF641500429), ref: 00007FF64150B110
Part of subcall function 00007FF64150B0DC: SetLastError.KERNEL32 ref: 00007FF64150B153

Part of subcall function 00007FF6414E129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414E1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641500490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641500496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6415004F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641500532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641500538

Strings

%ls, xrefs: 00007FF6414FF3AC, 00007FF6414FF3FF
%s: %s, xrefs: 00007FF6414FFC11

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction ID: e54cd58602da732e30bf7dbce4fb816e291c698c92e23809ef95b94f908221eb
Opcode Fuzzy Hash: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction Fuzzy Hash: 71B2C5A2E5C68241EB16BB69E4541FA6712EFC67D4F104236E6AD83BF6EF2CD140C704

Function 00007FF641522550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF641522C12
memcpy_s.LIBCMT ref: 00007FF6415235BF
memcpy_s.LIBCMT ref: 00007FF641523666

Part of subcall function 00007FF6415238BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6415238EE

memcpy_s.LIBCMT ref: 00007FF64152372F

Part of subcall function 00007FF64151D008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF64151D02D

Strings

1#IND, xrefs: 00007FF6415237AA
1#QNAN, xrefs: 00007FF6415237E8
1#SNAN, xrefs: 00007FF6415237C9
1#INF, xrefs: 00007FF641523807

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 1f3c83ebd93cd61d8572d8f7e2b0e789751393a27443dcc36dad563ee003871a
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 11B2F8B7E0C1828AE76ABF65D5406F937A1FB48788F105535DA2A97BA4DF38E5048F00

Function 00007FF6414F1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6414F1A97
GetLongPathNameW.KERNEL32 ref: 00007FF6414F1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF6414F1B21
GetShortPathNameW.KERNEL32 ref: 00007FF6414F1B6A

Part of subcall function 00007FF6415013C4: CompareStringW.KERNEL32 ref: 00007FF6415013E3

MoveFileW.KERNEL32 ref: 00007FF6414F1DFE
MoveFileW.KERNEL32 ref: 00007FF6414F1E65

Part of subcall function 00007FF6414F2134: CreateFileW.KERNEL32 ref: 00007FF6414F223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F1FED

Strings

rtmp, xrefs: 00007FF6414F1CF4, 00007FF6414F1D03

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction ID: 9c03227dfe4056319e4552b6b539a537953c41e5e1bb22299229e0362b188509
Opcode Fuzzy Hash: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction Fuzzy Hash: 1AF1C062B0CB8285EB11FB65D4901FE67A2EB95BD4F500132EA5D83BA9DF3CD584C740

Function 00007FF6414F5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6414F5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF6414F5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF6414F5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF6414F5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F5EF2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: c4c92b12a6770d14414b91c020f29c940cb1c0b0aacfe8664998f7f714330349
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: 00A1A272F19B5285FF16FBB998441BC2362AB45BA4B144235DE3E9BBD9DE3CE0418304

Function 00007FF641513170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF64151318C
RtlCaptureContext.KERNEL32 ref: 00007FF6415131B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6415131D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF641513214
IsDebuggerPresent.KERNEL32 ref: 00007FF641513268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF641513289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF641513294

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 68342f550446e910ac47df00a9aef19765e8b296258526e1af6329455ded3fa4
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 6D3172B3A08B818AEB65AF60E8503ED37A4FB94744F444039DA9D87BA8DF3CD548C700

Function 00007FF6415176D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF641517751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF641517769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6415177A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6415177DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6415177E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6415177F2

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: e2412dcaed95aad15355aa40e0415925f362375bba7a004105461ea18a4e2d65
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: C1319472A08B8186D766EF65E8402EE77A4FB84754F540135EEAD83B68DF3CC145CB00

Function 00007FF6414E1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414E1EBB

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction ID: 3465d4fbf7cae6f73be4bfc6ba5607b53c7483edafdc17f443c2f9a291dec5f4
Opcode Fuzzy Hash: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction Fuzzy Hash: CBB1DF62F5878685EB16FB65D8402ED2361FB89B94F401231EA5D83BA9DF3CE640C300

Function 00007FF64151FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151FAC4

Part of subcall function 00007FF641517934: GetCurrentProcess.KERNEL32(00007FF641520CCD), ref: 00007FF641517961

Strings

., xrefs: 00007FF64151FEE4
*?, xrefs: 00007FF64151FAEB

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 5ca24cb1d1aec232279f6e700420a687df32b69ccb1760cf7744a4e85f3c3075
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 9C51E1A2F18A9581EB1BFFA298104F86BA5FB48BD8B444532DE2D47B94DF3CD4468300

Function 00007FF641522080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF64152210B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 5f4412049404d7c66715cf408500d3bb388a7552c39501da17150521d184dd35
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: BCD1CF76B1C28287DB29EF15B1846EAB7A1FB98784F148534CB5E97B54DE3CE841CB00

Function 00007FF6414EB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6414EBA9D), ref: 00007FF6414EB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6414EBA9D), ref: 00007FF6414EB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6414EBA9D), ref: 00007FF6414EB743

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: 82400ac47528959c697ebe0f2f484f5d520757b99762aa6aa96e35882fc86d01
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: E501627260C74282E715BF62B8501BA6391FB89BC0F084034EA9D87B55DF3CD6048B04

Function 00007FF64151FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF64151FEE4

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: bf3eefc607ec19e97e5b7fd02d5c3ec6706242153ce501498971333b95b5acb8
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: FD3125A2F0C68049EB66BE2698047F96A91AB84FE4F048335DE7C87BE5CE3CD5058300

Function 00007FF641525AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF641525D45
RaiseException.KERNEL32 ref: 00007FF641525D56

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: ce8ef5752aad9112fcaf59cfd99f68018f1795627b7e5a165cbee904128f815e
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 6CB13CB3618B858BEB1AEF29C8453E87BA0F744B58F158921DA6D877B4CF39D451CB00

Function 00007FF641508DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6415085E0: GetDC.USER32 ref: 00007FF6415085EC
Part of subcall function 00007FF6415085E0: GetDeviceCaps.GDI32 ref: 00007FF6415085FD
Part of subcall function 00007FF6415085E0: ReleaseDC.USER32 ref: 00007FF64150860A

GetObjectW.GDI32 ref: 00007FF641508E48

Part of subcall function 00007FF6415090B0: GetDC.USER32 ref: 00007FF6415090D9
Part of subcall function 00007FF6415090B0: GetObjectW.GDI32 ref: 00007FF641509107
Part of subcall function 00007FF6415090B0: ReleaseDC.USER32 ref: 00007FF6415091BB

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 3a477f9b2a3166e21849eb80f422f85f3451564e6570a8483ec33e56e557bdb3
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 49812BB6B58A058AEB25EFAAD4406ED3771FB88B88F004122DE1D97768DF3CE545C740

Function 00007FF64150A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF64150A315
GetNumberFormatW.KERNEL32 ref: 00007FF64150A371

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: d630222901f91dd30150f7a67e97a16053f67058ae5925c6f6e02935b45587d3
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: BC116D72A1CB8595E766AF51F8003E97360FF88B44F844135DA9D83A64DF3CD156C748

Function 00007FF6414F126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F24C0: CreateFileW.KERNELBASE ref: 00007FF6414F259B
Part of subcall function 00007FF6414F24C0: GetLastError.KERNEL32 ref: 00007FF6414F25AE
Part of subcall function 00007FF6414F24C0: CreateFileW.KERNEL32 ref: 00007FF6414F260E
Part of subcall function 00007FF6414F24C0: GetLastError.KERNEL32 ref: 00007FF6414F2617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F15D0

Part of subcall function 00007FF6414F3980: MoveFileW.KERNEL32 ref: 00007FF6414F39BD
Part of subcall function 00007FF6414F3980: MoveFileW.KERNEL32 ref: 00007FF6414F3A34

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: a3f7aeee67f5c6efee88f6f2c4f2f574ca9db3d7719bf1359f9a84a60e1a1e68
Instruction ID: e3b6d3c346799df705bd5aea0f6692237be2986ca5e0968d40082cd8703bece8
Opcode Fuzzy Hash: a3f7aeee67f5c6efee88f6f2c4f2f574ca9db3d7719bf1359f9a84a60e1a1e68
Instruction Fuzzy Hash: F091DD62B2CA4682EB12FB62D4446AE6362FB94FC8F441032EE1D97B95DF3CD545C700

Function 00007FF6414F51A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6414F51D5

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: ab5d51880e707b7d745ea5895d62177f01965795af25f37c980c285aee1df1f1
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: BF01D7B5D0C5468AE76ABB10E8517BA73A2BB98314F600234E66D877A4DF3CE4058F04

Function 00007FF641518C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF641518DD3

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 22c6175987a8c5d061fa47c3721a455f015975ae23b8c7c101c8879f8e06ef4e
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 2581F3A2E5C24246EBBFBE1580806FD2B91EF51748F941531DD29CBAB9CF2DE846C740

Function 00007FF6415189A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF641518B3A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: ef09811cd680cb8675fad295b006dd3e99ca5f32cb13625e022ea1914339c459
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: B171F5E2E8C24247EB7FBE2940802FD2F91AF41754F181931DD29C76BACE6DE8468741

Function 00007FF6414FC96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF6414FC97B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: c87e5df803348fc6bb7d6f3a3c9d7fcc4597ce6de5aecb979618ef9fcbe31461
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: EF519137B286908BD715CF25E400A9E73A5F388758F445126EF5A93B05CF39E945CF40

Function 00007FF64151C838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF64151C874

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 56b169c21e3add78690791cb7e07bdc5d6ff8e334d4d3c6b8543e6c8cb182ce5
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 8B41B0A2B18B5886EB09EF2AD4552E977A1A758FD0B499036DE2DC7764DE3DD042C300

Function 00007FF641520D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF641520D24

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 49afc5d2a900ef837da8462514e404d33abeb687a98edcc87e7583bb47ec9a02
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 98B09260E1BA02C2EB0EBB556C823D822E4BF58700F948038C11C81330DE3C20B54B00

Function 00007FF641503964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction ID: f9dc06a4ef4e784279c048522d6472168fbda432782f90c2a17b663ebfea6243
Opcode Fuzzy Hash: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction Fuzzy Hash: 4A8208A3A0D6C18AD75AEFA4D5042FC3F61E756B88F198136CA6E873A6DE3CD445C310

Function 00007FF6414E76C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 1acb6736070106712280696a532f9efeb663fd164873568d9f24118cd2774e55
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 1B627F9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF6415053F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction ID: 8f74d39216e698f698e93f90054f8cb88d92e8ecda087f5775238d759f1b2ba1
Opcode Fuzzy Hash: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction Fuzzy Hash: D88211B3A1D6C18AD71AEE68D4046FC7B61F753B48F098236CA6D877A5CE3C9885C710

Function 00007FF6414FBB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: c9d7295b54bc05676d8de37bd4e7d476966498fcc1d71ba157f189691819ab7b
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: C722E3B3B246508BD728CF25C89AE5E3766F799744B4B8228DF0ACB785DB38D505CB40

Function 00007FF641504B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: bf565655519f9af332eaa389a9140642a25a49c43042c72626272b06c3ca3921
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: E732F0B2A181818BE71EEF24D550AFC3BA1F756B08F058139DA6A87B95DF3CE850C740

Function 00007FF6414E7288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 97bf43d9375b0a53e414265125946d8f1522b19335c826e646e19050f89831e7
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 65C19CB7B281908FE351CF7AE400A9D3BB1F39878CB519125DF59A3B09D639E645CB40

Function 00007FF641502D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: f3bbd8bdf44a15809f56787a76592f115a37d43190fbd29a5fdf155a3bf77989
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 0EA149B3A0C1824AEB2BFA64E4047FD2B91EB9278CF554535DA6D87795DE3CE881C700

Function 00007FF6414FAF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 50ec38019b06aaf92d26662f3db98e44a6da60da162d9780a4f9933246147cd9
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: C2C1E677B291E04DE302CBB5A4248FD3FF2E71E34DB4A4151EFA666B4AD6285201DF60

Function 00007FF6414EA310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: d000bfb3791468e54e4108d780a9a14c9754b909a4ea31ac947ccbe05c2ee5d6
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 2A91EE62B1C68196EB12FF29D4516ED6721FF95788F441031EE4E87B99EF38E64AC300

Function 00007FF6414FB534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 697c740dd57a0187ea56773f2651ddf285b0c825a03019137309f74ee13df5ee
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 77611362B1C1D549EB02EF7585044FD7FA2AB0A788B498032CEAE97746CE3CE506CB14

Function 00007FF6415021D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 392f1259a58cdf7a4e33bb3504c9e621f8c271edea8dae7c16c79d8660ddd3af
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: DC5102B3B1C1514BE72AAFA8E1187ED3B51FB90B48F448134DB5987A98DE3DE545CB00

Function 00007FF641502AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: d0df083728ddfda4361ceb957e069f3919bb56f41558ac9024672e28312f2e44
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 4631D0A2A0C6814BD75DEE5AEA512BE6BD1F745388F048139DB5AC3B82DE7CE041CB00

Function 00007FF6415258E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: a6f2c15400f6eecb087d42d422bb387446494cea3f3ee7a623d01dd1b8ff7646
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: DEF044B271C2558BDBA9EF29A4437697B90E708380F448039D599C3A14DA3C9470CF04

Function 00007FF641513354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 2b9688b6c0f5a4e3005ae07f1d79f44be4bea2c95534c8ddaa246498d7a16f46
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 8FA001A694C842D0E78ABB50A9600F06A60BB60310B540031E06D811B49E3CA401C604

Function 00007FF6414ED7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED964

Strings

::$OBJECT_ID, xrefs: 00007FF6414ED880
::$EA, xrefs: 00007FF6414ED81D
::$REPARSE_POINT, xrefs: 00007FF6414ED88B
::$ATTRIBUTE_LIST, xrefs: 00007FF6414ED7FC
::$FILE_NAME, xrefs: 00007FF6414ED833
::$INDEX_ROOT, xrefs: 00007FF6414ED854
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6414ED85F
::$BITMAP, xrefs: 00007FF6414ED807
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6414ED875
::$EA_INFORMATION, xrefs: 00007FF6414ED828
::$DATA, xrefs: 00007FF6414ED812
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6414ED86A
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6414ED849
::$INDEX_ALLOCATION, xrefs: 00007FF6414ED83E

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction ID: 1542709dcae2b50244bf6d16056f342733a829bb105092f1ae1b3455d6a16840
Opcode Fuzzy Hash: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction Fuzzy Hash: FE41E776B49F0199EB06EF64E8403E933A9EB08798F500136DA6C97B68EF38D155C744

Function 00007FF641512A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF641512A26
GetModuleHandleW.KERNEL32 ref: 00007FF641512A33
GetModuleHandleW.KERNEL32 ref: 00007FF641512A48
GetProcAddress.KERNEL32 ref: 00007FF641512A60
GetProcAddress.KERNEL32 ref: 00007FF641512A73
CreateEventW.KERNEL32 ref: 00007FF641512A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF641512AEB
CloseHandle.KERNEL32 ref: 00007FF641512AFD

Strings

WakeAllConditionVariable, xrefs: 00007FF641512A66
kernel32.dll, xrefs: 00007FF641512A41
SleepConditionVariableCS, xrefs: 00007FF641512A56
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF641512A2C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: aace7b23e2bb146b5097f0a2a908571071ee8c7ac7d37488f33ba6d73ddcd4f7
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: B521E9E6E5DA0785FB5FBF91F8552F827A0AF58780F640035C96E826B0DE7CB4958600

Function 00007FF6414F6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70A6

Part of subcall function 00007FF6414E2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6414E200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F70DC

Strings

UNC, xrefs: 00007FF6414F6BBF
DXGIDebug.dll, xrefs: 00007FF6414F6A18
\\?\, xrefs: 00007FF6414F6A57, 00007FF6414F6A66

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: caeda946b173b290eeb0eea351584ffd7bcd35d17f0c3fb79cdbd079912c01be
Instruction ID: 5cb0bd506f99bfc195da98c1130784c020c84f3fb297480ffbd564981d35c0b4
Opcode Fuzzy Hash: caeda946b173b290eeb0eea351584ffd7bcd35d17f0c3fb79cdbd079912c01be
Instruction Fuzzy Hash: E212BC62B0CB4284EB12FF65E4501AD6372EB85B98F504236DAAD87BE9DF3CD549C340

Function 00007FF64150A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414E129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6414E1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150A747
EndDialog.USER32 ref: 00007FF64150A7BA

Strings

GETPASSWORD1, xrefs: 00007FF64150A773
Software\WinRAR SFX, xrefs: 00007FF64150A52B, 00007FF64150A53A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: 8aeeffd900f0a4fb6f18bf1463f4856f3a1894bfe739fb49fd891a609c716d66
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: B1B1B2A2F1D74285FB06FBA4D4442FC27B2AB85798F504235DA2DA6AE9DF3CE145C304

Function 00007FF641506E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF641507E9B), ref: 00007FF641507080
CreateStreamOnHGlobal.COMBASE ref: 00007FF6415070B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641507181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641507187

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF641506F2C, 00007FF641506F3B
</html>, xrefs: 00007FF641506F72, 00007FF641506F81
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF641506ED5, 00007FF641506EE4
<html>, xrefs: 00007FF641506F13

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction ID: ae01b260516d6d3e896c37a5332d44950051ea79826bcf9fd6fc4ce30f7a4954
Opcode Fuzzy Hash: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction Fuzzy Hash: B581A1A2F1CA4685FB0AFBA5D4402ED2772AF45798F400135DE6D97AE9EF38D50AC300

Function 00007FF64151E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151E7CD

Strings

nan(ind), xrefs: 00007FF64151E706
inf, xrefs: 00007FF64151E6D6
nan(snan), xrefs: 00007FF64151E6F0
INF, xrefs: 00007FF64151E6C3
nan, xrefs: 00007FF64151E6B8
NAN(SNAN), xrefs: 00007FF64151E6E5
NAN(IND), xrefs: 00007FF64151E6FB
NAN, xrefs: 00007FF64151E6B1

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: c9228e42f4ce4aad41e2cbee2900bcf2693618142b70e70c61c6f90339025377
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 0541CDB6B09B4589EB0AEF24E8417E937A4EB18398F004536EE6C87B65DF3CD025C344

Function 00007FF64150F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF64150F3CF
GetClassNameW.USER32 ref: 00007FF64150F3FC
GetWindowLongPtrW.USER32 ref: 00007FF64150F41D
SendMessageW.USER32 ref: 00007FF64150F437
GetObjectW.GDI32 ref: 00007FF64150F452
SendMessageW.USER32 ref: 00007FF64150F487
DeleteObject.GDI32 ref: 00007FF64150F490
GetWindow.USER32 ref: 00007FF64150F49E

Strings

STATIC, xrefs: 00007FF64150F402

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: b2f19310c9d3f6e3a6e52741932858d34682717a33932894d1e555d46694622b
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 3031E4A1B0C64286FB6ABB52A5507FA6791FF8ABC4F014030DD6D87B66DF3CE4028740

Function 00007FF64150AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF64150AEAE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 4168aebfdaa59bbb4797baf1848a49482118ef356f1d1a898bdb69097a899cd9
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: EE419FA5B0CA5282FB1ABB51E9547F927A1EF85B84F044035D92EC3BB5CF3CE9468304

Function 00007FF6414FB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6414FBA12
GetProcAddress.KERNEL32 ref: 00007FF6414FBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF6414FBACA

Part of subcall function 00007FF6414FDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF6414FDDDF

Strings

CryptUnprotectMemory, xrefs: 00007FF6414FBA1F
CryptProtectMemory, xrefs: 00007FF6414FBA08
CryptUnprotectMemory failed, xrefs: 00007FF6414FBAC1
Crypt32.dll, xrefs: 00007FF6414FB9F0
CryptProtectMemory failed, xrefs: 00007FF6414FBA80

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: 8232d6ed4cdc65222c782c95daed0535124db0ddd687b22e4ed778b3ddbb0014
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 0A315AA5E0DB0280FB1BBB16B8542B527A1EF45B91F184135C96EC37B4EE3CE5598708

Function 00007FF6415087D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641508DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641508DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641508DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641508DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF641508DE0

Strings

, xrefs: 00007FF641508A55
, xrefs: 00007FF6415088BE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction ID: afcbbd985caa3cd3a97cef07534ca1cfc3c1f983ad11bc5cfb06db734e622c11
Opcode Fuzzy Hash: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction Fuzzy Hash: 9FF1AFA2F18B4680EF0ABBA4D4445FC2B61AB55BA8F505631CA7D977E5DF7CE1808340

Function 00007FF6415157EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF64151598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF641515CAD
abort.LIBCMT ref: 00007FF641515CE1

Strings

csm, xrefs: 00007FF6415158D1
csm, xrefs: 00007FF6415159B1
csm, xrefs: 00007FF641515933

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: e4469e8672943972ea7c7fc3b26c384bf013bb8f906bc081106dbf088fc9c6b4
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 1EE180B3E1C6828AE716BF25D4803ED7BA0FB46758F144235DAAD876A5CF38E585C700

Function 00007FF6414F4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F4E24: SysAllocString.OLEAUT32 ref: 00007FF6414F4E5F

VariantClear.OLEAUT32 ref: 00007FF6414F5125

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6414F5017
WQL, xrefs: 00007FF6414F502A
Name, xrefs: 00007FF6414F50F9
Windows 10, xrefs: 00007FF6414F510A
ROOT\CIMV2, xrefs: 00007FF6414F4F7B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 46db897126f2353d69f69e80a08990677487bf4c4ca32dd6b499146db19f2c13
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 50712C76B18A0585EB15EF65E8805ED77B1FB88B98B045132EA5D87B78DF3CE144C700

Function 00007FF6415172EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6415174F3,?,?,?,00007FF64151525E,?,?,?,00007FF641515219), ref: 00007FF641517371
GetLastError.KERNEL32(?,?,00000000,00007FF6415174F3,?,?,?,00007FF64151525E,?,?,?,00007FF641515219), ref: 00007FF64151737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6415174F3,?,?,?,00007FF64151525E,?,?,?,00007FF641515219), ref: 00007FF6415173A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6415174F3,?,?,?,00007FF64151525E,?,?,?,00007FF641515219), ref: 00007FF6415173EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6415174F3,?,?,?,00007FF64151525E,?,?,?,00007FF641515219), ref: 00007FF6415173FB

Strings

api-ms-, xrefs: 00007FF641517391

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: bade049840878e0be31bb5f20946a12758554341c80cc9dbe0ddeaa7509509c4
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 4831AFA2E1E64281EF1BBF4AA8005F52A94FF08BA4F594935DD3D8B7A0DF3CE0408710

Function 00007FF641511604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF641511573,?,?,?,00007FF64151192A), ref: 00007FF64151162B
GetProcAddress.KERNEL32(?,?,?,00007FF641511573,?,?,?,00007FF64151192A), ref: 00007FF641511648
GetProcAddress.KERNEL32(?,?,?,00007FF641511573,?,?,?,00007FF64151192A), ref: 00007FF641511664

Strings

KERNEL32.DLL, xrefs: 00007FF641511624
AcquireSRWLockExclusive, xrefs: 00007FF64151163E
ReleaseSRWLockExclusive, xrefs: 00007FF641511653

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 9221512cc7ac2cca3917760c7833d3bc38f3ad212767fed065fe68d59141aac2
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 7C113CA1E5DB0695FF5FBF60A9802F416916F08790F5C4875C83E8ABB5EF3DB4548A00

Function 00007FF6414FED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F51A4: GetVersionExW.KERNEL32 ref: 00007FF6414F51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6414E5AB4), ref: 00007FF6414FEE05

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 2fa252cdb54dc5d773e4e48fdb0c8af414d00a3e62552594d6262f07ef008095
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 70517DB2B146518AEB15EFA8E4401EC37B1F748798B60403ADE1DA7B58DF38E556CB00

Function 00007FF6414FF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6414FF074

Part of subcall function 00007FF6414F51A4: GetVersionExW.KERNEL32 ref: 00007FF6414F51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6414FF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF6414FF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6414FF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF6414FF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF6414FF0CE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 62eba63179ba825676bf6e60d22f78f33127ca25a2333be29329dd7c8c9fcfdd
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 6E314C63B14A518EFB05EFB5D8801EC3771FB08758B54502ADE1DA7A68EF38D895C710

Function 00007FF6414F7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F7C8C

Strings

sfx, xrefs: 00007FF6414F79F3, 00007FF6414F7A02
exe, xrefs: 00007FF6414F79AF, 00007FF6414F79BE
.rar, xrefs: 00007FF6414F7969, 00007FF6414F7978
rar, xrefs: 00007FF6414F7A9B, 00007FF6414F7AAA, 00007FF6414F7B67, 00007FF6414F7B7C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction ID: b486a6c2a8449955fe90078de8755db759e5bf3bee4b2706f581852d0e8dbcc2
Opcode Fuzzy Hash: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction Fuzzy Hash: F4A1AC62A0CA4680EB06BF65D8452FC2362AF55BA8F501235DE3D877EADF3CE585C340

Function 00007FF641515CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF641515D58

Part of subcall function 00007FF641515210: abort.LIBCMT ref: 00007FF641515223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF641515DA3
abort.LIBCMT ref: 00007FF641515FD1

Strings

MOC, xrefs: 00007FF641515D6C
RCC, xrefs: 00007FF641515D74

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: f76a095716a774cc2b0bd64ea07f4f801b32ab5546270ea62649ccaa6dc93657
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: F891AEB3E18B818AE716EF65E4802ED7BA0F705788F104129EE5D97B65DF38D195CB00

Function 00007FF641514F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF641514FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF641515040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF641512F5E), ref: 00007FF64151508F

Strings

csm, xrefs: 00007FF641515026
f, xrefs: 00007FF641514FBE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 563257e62f054af61c28330c14ffb874179cd6e3e9021c6c5a69a4d4ba067918
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 1E519072E2D60286DB1BFF25E444AA93B95FB45B88F508034DA6E87758DF78E841C740

Function 00007FF6414ECEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6414ED03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED0D7

Part of subcall function 00007FF6414EDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6414ECF4B), ref: 00007FF6414EDE27
Part of subcall function 00007FF6414EDE04: GetLastError.KERNEL32 ref: 00007FF6414EDE88
Part of subcall function 00007FF6414EDE04: CloseHandle.KERNEL32 ref: 00007FF6414EDE9B

Strings

SeRestorePrivilege, xrefs: 00007FF6414ECF5E
SeSecurityPrivilege, xrefs: 00007FF6414ECF3F

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction ID: e130fcc147e5b95c267f262283da67f6bc0069e2e821d0babce0bcef84554f83
Opcode Fuzzy Hash: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction Fuzzy Hash: F951BCA2F1C74285FB16FB65D8412FD27A1AF857A8F140131DE2D97AA6DF3CA985C300

Function 00007FF641507B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF641507B6F
GetWindowRect.USER32 ref: 00007FF641507BC0
ShowWindow.USER32 ref: 00007FF641507C96
ShowWindow.USER32 ref: 00007FF641507CC3

Strings

RarHtmlClassName, xrefs: 00007FF641507C4B

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: 1717c6072af34815376ee38685867f35ca54ef3d0c93680137a27960621f4914
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: 3E519662A0CB818AEB2AFF65E5453BA6760FF85784F044435DE9E83B65DF3CE4458700

Function 00007FF64150FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF64150FD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF64150FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64150FE1B

Strings

sfxcmd, xrefs: 00007FF64150FD3C
sfxpar, xrefs: 00007FF64150FDB5

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 747fbfb8359b466a4e5a46d89ac5d9cd1d048a165bfbbd563fce7fab1364fa14
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: 7431A1B2A18A0684EB09BBA5E4841EC3771FB49B8CF144132DE2D97BB9DF38D041C344

Function 00007FF64150FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00007FF64150FF34, 00007FF64150FF99
RENAMEDLG, xrefs: 00007FF64150FF60

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: 3df2cb05fb3c0db431f3276c812e1951d4cd2416cf22c0660ee26562c301f8b8
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: B02127A6A0CA4781FB1BBB55B8442F427A0EB4AB88F144436D9ADC7234CE3CE1A48340

Function 00007FF64151BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF64151BFD0
GetProcAddress.KERNEL32 ref: 00007FF64151BFE6
FreeLibrary.KERNEL32 ref: 00007FF64151C00B

Strings

CorExitProcess, xrefs: 00007FF64151BFDF
mscoree.dll, xrefs: 00007FF64151BFC7

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: c7c0f6dae0eb6005dcd4e7652d78ee3b50e11570d85439efe53f31e42e785fe5
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 9CF04FA6A1DA4281EF5EBB91E4802F967A0AF88794F441035D96F86675DE3DE4848B00

Function 00007FF6415245C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF641524605

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 25b1014331334c181221f291adc6bac42ad148f32ac4fa84a6768fad08f6365c
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 9381D3A3F2C65289F72ABF65D8406FD26A0BB45B84F044135DE2E936B5CF3CA442CB10

Function 00007FF6414F3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6414F3BBB
CreateFileW.KERNEL32 ref: 00007FF6414F3C24
SetFileTime.KERNEL32 ref: 00007FF6414F3CEC
CloseHandle.KERNEL32 ref: 00007FF6414F3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F3D2C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction ID: b9c1ee939199c0177cedddb3ec2ae45e8f9d7a55eb5b6fa3bcc3124d9cecb2bf
Opcode Fuzzy Hash: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction Fuzzy Hash: 9451BF62F0CA4259FB56FFA5E9503BD23B2AB487A8F004635DE2D867D9DE3C9545C300

Function 00007FF641523F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF641524767), ref: 00007FF641523F91
WideCharToMultiByte.KERNEL32 ref: 00007FF64152406D
WriteFile.KERNEL32 ref: 00007FF641524093
WriteFile.KERNEL32 ref: 00007FF6415240D2
GetLastError.KERNEL32 ref: 00007FF64152410A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 3226450bf61bd783d6d154afb5257a9f7225e4efa53fca0bd58ca1203016a91d
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 9A51B0B3B18A5189E71AEB65D4443EC3BB1BB44798F148135CE6E97AA8DF38D145CB00

Function 00007FF641511E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6414F4DF4), ref: 00007FF641511E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6414F4DF4), ref: 00007FF641511F09
SysAllocString.OLEAUT32 ref: 00007FF641511F16

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction ID: 14607eb6f5c3ee7245bd0a957c3d409f570a235fc26dc4ef2ec03a7f98650784
Opcode Fuzzy Hash: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction Fuzzy Hash: 214190A1E0D64689EB1BBF7194802F92A91EF44BA4F544634EA7DC77E6DF3CE1418310

Function 00007FF64151F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF64151F536

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 7092f6ba27d5bde3d8f5a6da135b46e01bb5c107461f9bc9a22827e8938c4979
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: D841B2A2F0DA4281FB1BBF56A8005F56695BF54B90F0A4536DD3DCBBA4EE3CE4448300

Function 00007FF6415256D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6415256FF
_set_statfp.LIBCMT ref: 00007FF64152571A
_set_statfp.LIBCMT ref: 00007FF641525736
_set_statfp.LIBCMT ref: 00007FF641525772

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 157b862b4993deba77f29f92e017ed5d9559855940250dcf394eda58dd557431
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 49116DB7EBCA0785F75E3324E5423F911416F553E0F4C8274EA7E8A6F69E2CA4444A05

Function 00007FF64150FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF64150FE41
GetMessageW.USER32 ref: 00007FF64150FE58
TranslateMessage.USER32 ref: 00007FF64150FE63
DispatchMessageW.USER32 ref: 00007FF64150FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF64150FE7C

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: a6c7348a5900618246299307806565cbb3f10527a0e776ed089c97a382967599
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: A1F04F62B2C54683F755B760E554BFA2261FFA4B05F445030E95E818A49E3CD559CB00

Function 00007FF64151625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF641516286
abort.LIBCMT ref: 00007FF6415164EA

Strings

csm, xrefs: 00007FF6415162AB
csm, xrefs: 00007FF64151641A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 2bfdbcb3cea4ccefa0e4361060e9eff72fc8056e8faebb8eb62e10aa0dbc1e8f
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 2C71B0A2A0C69186D76BBF25D0907BD7FA1EB01B88F048135DE6C87AA5CF7CD891C740

Function 00007FF6415180F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6415182ED

Strings

*, xrefs: 00007FF641518221
, xrefs: 00007FF641518276

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: c13817e582409ae1874f4a778ad573a4bcd1bb60477d94fe9dae0a7790d6fb51
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 835134B2D8CA428AE77FBE2884443FC3FA1FB16B18F141135D67A852A9CF6CD481C605

Function 00007FF641521758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6415217CB
MultiByteToWideChar.KERNEL32 ref: 00007FF641521894
GetStringTypeW.KERNEL32 ref: 00007FF6415218AE

Strings

$%s, xrefs: 00007FF64152175A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 901f06ee4b0b5bc3963f9168ece4fc7665e4da1be6b5e0346778ed5a36dc652d
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: C0419963B18B8149EB6ABF65D4802E96391FB44BA8F480235DE2D877E5DF7CE5418700

Function 00007FF6415166A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF641515210: abort.LIBCMT ref: 00007FF641515223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF64151674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF641516776

Strings

csm, xrefs: 00007FF641516876

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 05e6c6e7115d79a62761ec9b2fda64fc5177c92dc7054affa03b359d022a59ae
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 25512CB7A2D74186D726BF15E0402AE7BA4FB89B90F140534EAAD87B65DF3CD451CB00

Function 00007FF641524360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF641524446
WriteFile.KERNEL32 ref: 00007FF641524479
GetLastError.KERNEL32 ref: 00007FF64152449B

Strings

U, xrefs: 00007FF641524424

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 85b856272f9dd02403a5c536ad153695ef859f200a28887ed6343e0bce78a365
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: E241BF63A1CA8182EB25AF65E8443FAA7A0FB98794F444131EE5DC77A8DF7CD441CB40

Function 00007FF6415090B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6415090D9
GetObjectW.GDI32 ref: 00007FF641509107
ReleaseDC.USER32 ref: 00007FF6415091BB

Strings

, xrefs: 00007FF641509153

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 642a7108b1ad7114a3fbf56415dfb2d5a1977bc8b1451d959e7411b922c249c7
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: BC31297570874286EB19AF12B91876AB7A0F789FD1F404435ED6E93B64CE3CE4598B00

Function 00007FF6414FE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF64150317F,?,?,00001000,00007FF6414EE51D), ref: 00007FF6414FE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF64150317F,?,?,00001000,00007FF6414EE51D), ref: 00007FF6414FE8CB
CreateEventW.KERNEL32(?,?,?,00007FF64150317F,?,?,00001000,00007FF6414EE51D), ref: 00007FF6414FE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF6414FE900

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 2c181cf555e1afa28b14043daf8722cd4fd33f1a6a3cc2c3232c27c4e6a5f5fd
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: CD21D272F1D60186F716BF24E4447ED32E2EB98B09F288034CA1D8B2A5CF7E9555CB84

Function 00007FF6415085E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6415085EC
GetDeviceCaps.GDI32 ref: 00007FF6415085FD
ReleaseDC.USER32 ref: 00007FF64150860A

Strings

, xrefs: 00007FF641508610

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: b2da34da8f8f0dc354c26ce443b2bbec36a8bca734d391a8af3fc2f5e2d6356a
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: E4E0C260B0C64186FB1D77BAB68923E6261EB4CBD0F158035DA2F837A4CE3CC4E48300

Function 00007FF6414ED1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6414ED46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414ED560

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction ID: 1a4c77222f589bf1c1d9053ca489294f5b1a6256f974da0c06571d564bb997d5
Opcode Fuzzy Hash: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction Fuzzy Hash: DCA1A062A1CB8281EB12FB65E8401EE6362FF95794F405531EA9D87AE9DF3CE644C700

Function 00007FF641500548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6415005FC
SetLastError.KERNEL32 ref: 00007FF641500697

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction ID: 18f70fd3bb134e3b50ec876ab3e8546fabf6e2f9192e363b1d1ecfb06c9be6d4
Opcode Fuzzy Hash: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction Fuzzy Hash: 335191A2F58B4685EB06BFA4D4452EC2322EB85BDCF504132DA6C97BE6DF2CD245C344

Function 00007FF641509D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF641509DBC
GetLastError.KERNEL32 ref: 00007FF641509E08
CreateDirectoryW.KERNEL32 ref: 00007FF641509F10
LocalFree.KERNEL32 ref: 00007FF641509F20

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction ID: a4757ed0ce7cdaed6a82a9c0b3b5031ffdc8e921f87170b1dea17572a69c561c
Opcode Fuzzy Hash: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction Fuzzy Hash: 3B519172A1CB4286E716AF61E4443EE77B4FB85B84F500039EA6D97A68DF3CD414CB00

Function 00007FF64151DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151DBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF64151DC81
GetLastError.KERNEL32 ref: 00007FF64151DCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151DCD6

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: be49bb02e139bed4dda6af17961930e304458fc04dc203aff9456a044097e55b
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: F24174B2E0C64246FB6FBF15D1483F97A90EF90B94F148931DA6D86AE5DF6CD8418B00

Function 00007FF6414F3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6414F39BD
MoveFileW.KERNEL32 ref: 00007FF6414F3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F3AF1

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction ID: 760f367a17e10b9ee5e15721b24a6f1cecae3b5464043e705dd95fbf22d100fa
Opcode Fuzzy Hash: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction Fuzzy Hash: 01418162F18B5184FB01FFB6E8451AC2372BB44B94B105235DE6D97BA9DF78D445C300

Function 00007FF641520B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF64151C45B), ref: 00007FF641520B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF64151C45B), ref: 00007FF641520BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF64151C45B), ref: 00007FF641520C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF64151C45B), ref: 00007FF641520C57

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 9b26555f60614e9f84beb0618d3351e6455f1bbfd1b4a20ddba0bbd78ca9cbde
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: E22189B2F1DB9181D769BF11A4400A9B6A5FB54BD0B484134DEADA3BB4DF3CD4528704

Function 00007FF64151D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF641517F28,?,?,?,00007FF641519D35), ref: 00007FF64151D44A
SetLastError.KERNEL32(?,?,?,00007FF641517F28,?,?,?,00007FF641519D35), ref: 00007FF64151D4B2
SetLastError.KERNEL32(?,?,?,00007FF641517F28,?,?,?,00007FF641519D35), ref: 00007FF64151D4C8
abort.LIBCMT ref: 00007FF64151D4CE

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 973817a02bc7d45f70654f2fd83e7c075c966d859575508488558290f162c617
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: D9018CA1F4C74642FB5F7B71A6591F829A25F44790F040838D93EC2BF6EDACB8058200

Function 00007FF641508590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF641508598
GetDeviceCaps.GDI32 ref: 00007FF6415085AE
GetDeviceCaps.GDI32 ref: 00007FF6415085C2
ReleaseDC.USER32 ref: 00007FF6415085D3

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 14eead1f68909b1adb7d2449c12c70491e46277f7b75ec0c1d96521005190680
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: ABE0EDA0F0D70282FF1E7B75A9592762190EF48741F084439C83F86370DD3CA0A5C614

Function 00007FF6414EE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414EE549

Strings

DXGIDebug.dll, xrefs: 00007FF6414EE35A

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: af41f5b367367adcbbc9fbea96428c46d5ee0daf519fd66926152a8cf2950bdf
Instruction ID: 06ec227911b309e83cfacb6604d97b936f1b13b3a3f2299fa1caeaabf663b90e
Opcode Fuzzy Hash: af41f5b367367adcbbc9fbea96428c46d5ee0daf519fd66926152a8cf2950bdf
Instruction Fuzzy Hash: CD71CD72A08B8182EB15EF25E8403ADB3A9FB54B94F104236DBAD47BA5DF38D151C300

Function 00007FF64151E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151E237

Strings

e+000, xrefs: 00007FF64151E2DF
gfff, xrefs: 00007FF64151E362

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 488fa0fab37b0b9bc9d5bb8d96f6dae5ff099c4eda78270f63633758d168b44c
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: AA51C8A2F1C7C146E76BAF3599517E96E91E781B90F089231D6BC87BE5CF2CE4448700

Function 00007FF6414F9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414F95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6414F95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6414F95A2

Strings

SIZE, xrefs: 00007FF6414F9443

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: 139cf88e2526ec9ed09844373830357f437e2307c780167a54a0eccb056db033
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: 7941D0A2A1C68681EB16FF58E4453FD7312AF85798F505231FAAD867E6EE3CD140C704

Function 00007FF64151C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF64151C2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF641512CD5), ref: 00007FF64151C30B

Strings

C:\Users\user\Desktop\0442.pdf.exe, xrefs: 00007FF64151C2F9

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\0442.pdf.exe
API String ID: 3307058713-1489544898
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: b08ad3ad4774ff7ea3eabe7cb50109321b43c88cccd86d88dfcf96bd03f579b1
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 19419EB2E0CA528AEB1FFF25A4411FC7BA4EB44B84B444035E96E87B65DE3DE441C300

Function 00007FF641509B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6414E255C: GetDlgItem.USER32 ref: 00007FF6414E25AC
Part of subcall function 00007FF6414E255C: SetWindowTextW.USER32 ref: 00007FF6414E25C8

EndDialog.USER32 ref: 00007FF641509C24
SetDlgItemTextW.USER32 ref: 00007FF641509CAA

Strings

ASKNEXTVOL, xrefs: 00007FF641509B72

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction ID: fc03ad7faf6ff7b0bfb8da41744b916b99e27308cbbb5b0134f36297eff45602
Opcode Fuzzy Hash: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction Fuzzy Hash: 5841CFA2E1CA8281FB1ABB52E5543FA27A1BF86BC4F140035DE5D877A9CE3CE5518340

Function 00007FF6414F9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6414F96EA

Part of subcall function 00007FF641500F68: WideCharToMultiByte.KERNEL32 ref: 00007FF641500F99

Strings

@%s, xrefs: 00007FF6414F96CE
$%s, xrefs: 00007FF6414F96D7

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 86ea93e8faafbf0ca10efed3dd0c45b5802f5d027fad04ad3af0ce6e2fc20af7
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 7E31E2B2B1CA4695EB16BFA6E4403E923A1FB44788F500036EE2C877A5EF3CE505C700

Function 00007FF64151EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF64151EB76
GetFileType.KERNEL32 ref: 00007FF64151EB8C

Strings

@, xrefs: 00007FF64151EBB7

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 7fc5d8e41c605d5c8b8f0155666a7ba7171a628ed02c58adf85bd838180d1ba2
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: CA214FA2F0CA8241EB6BBF2594901B92A91FB45774F281335D67F867E4CE3DD881C351

Function 00007FF641514078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF641511D3E), ref: 00007FF6415140BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF641511D3E), ref: 00007FF641514102

Strings

csm, xrefs: 00007FF6415140EF

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: a5a22dc542a279f36466792b1a53fba2ddf0576ef9f47b423802cab70d3e5cd6
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: EB114F76A0CB4182EB26AF15E4402A97BE1FB88B94F184231DF9D47768DF3CD555CB00

Function 00007FF6414FEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6414FE95F,?,?,?,00007FF6414F463A,?,?,?), ref: 00007FF6414FEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6414FE95F,?,?,?,00007FF6414F463A,?,?,?), ref: 00007FF6414FEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6414FEA78

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 279f7fffa54bcdb9ed3d66183eade6b19a876aaef5732a09bad9de12d68bcbc5
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 69E04FA6E1D90291F706B770AC825F822517F60770FA00330D03EC25F59F2CAA498B05

Function 00007FF6414FA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6414FA447
FindResourceW.KERNEL32 ref: 00007FF6414FA45D

Strings

RTL, xrefs: 00007FF6414FA453

Memory Dump Source

Source File: 00000000.00000002.1725243679.00007FF6414E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6414E0000, based on PE: true

Associated: 00000000.00000002.1725191687.00007FF6414E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725282445.00007FF641528000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF64153B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725307381.00007FF641544000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725423591.00007FF64154E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6414e0000_0442.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: dc55afda68d17d62922904e4c00c03934f2d46f31dc31889c44d295722ad2c32
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: C4D05ED2F0D60682FF1EBBB1A4497F422905F18B41F584038CC6E863E4EE2CE088CB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0442.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\675fe0.rbs

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Windows Analysis Report
0442.pdf.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre