Edit tour

Windows Analysis Report
0442.pdf.exe

Overview

General Information

Sample name:	0442.pdf.exe renamed because original name is a hash value
Original sample name:	.pdf.exe
Analysis ID:	1580689
MD5:	4f6b2b9ee57c50d6c505d0cdada4803e
SHA1:	ad7dee6f1f71c4fe6299170a160592f139390e12
SHA256:	62410e8399acf7834c74012783bde3fe9ff244e048141c4a96a65bec06895f37
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Enables network access during safeboot for specific services

Enables remote desktop connection

Initial sample is a PE file and has a suspicious name

Uses an obfuscated file name to hide its real file extension (double extension)

Uses ping.exe to check the status of other devices and networks

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0442.pdf.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\0442.pdf.exe" MD5: 4F6B2B9EE57C50D6C505D0CDADA4803E)

msiexec.exe (PID: 7520 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

cmd.exe (PID: 7528 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7920 cmdline: ping 8.8.8.8 MD5: 2F46799D79D22AC72C241EC0322B011D)

Acrobat.exe (PID: 7556 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,18215150213972139035,17261459285525738276,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

Acrobat.exe (PID: 7664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

msiexec.exe (PID: 7608 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

ROMFUSClient.exe (PID: 7440 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8308 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8344 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8392 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8480 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8516 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start MD5: F3D74B072B9697CF64B0B8445FDC8128)

svchost.exe (PID: 8096 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ROMServer.exe (PID: 8532 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 8668 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8692 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8700 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8784 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8868 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8900 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8964 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8516 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 5292 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 980 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
13.0.ROMServer.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
12.0.ROMFUSClient.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0442.pdf.exe", CommandLine: "C:\Users\user\Desktop\0442.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\0442.pdf.exe, NewProcessName: C:\Users\user\Desktop\0442.pdf.exe, OriginalFileName: C:\Users\user\Desktop\0442.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\0442.pdf.exe", ProcessId: 7428, ProcessName: 0442.pdf.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 101.99.91.150, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: , Initiated: true, ProcessId: , Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49977

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8096, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0442.pdf.exe	Virustotal: Detection: 47%			Perma Link
Source: 0442.pdf.exe	ReversingLabs: Detection: 26%

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: 0442.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0442.pdf.exe

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FEB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF600FEB190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF600FD40BC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FFFCA0 FindFirstFileExA,	0_2_00007FF600FFFCA0

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 101.99.91.150 ports 5651,8080,1,5,6,80

Enables network access during safeboot for specific services

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry value created: NULL Service

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8

Source: global traffic

TCP traffic: 192.168.2.4:49746 -> 101.99.91.150:5651

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.91.150

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000009.00000002.2934887641.000001AFCD800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ROMFUSClient.exe, 0000000C.00000000.1788377420.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1794843487.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000012.00000002.2933625053.000000000176C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000288C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000278C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/
Source: ROMFUSClient.exe, 00000015.00000002.2933461192.0000000002893000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03
Source: ROMServer.exe, 00000012.00000002.2933625053.0000000001773000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03w
Source: ROMServer.exe, 00000012.00000002.2933625053.000000000176C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000288C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/1
Source: ROMFUSClient.exe, 0000000C.00000000.1788377420.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1794843487.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Russian.lg.5.dr	String found in binary or memory: http://litemanager.ru/
Source: ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://litemanager.ru/noip.txtU
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://s2.symcb.com0
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ROMFUSClient.exe, 0000000C.00000003.1802761701.0000000002797000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 0000000D.00000003.1796931420.0000000002A27000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000E.00000003.1817573851.0000000002787000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000F.00000003.1815885695.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000003.1852583819.00000000028C7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.1847150962.00000000029E7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.2933625053.00000000016D7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.2932912602.0000000002847000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000003.1850601689.0000000002997000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000003.1859519529.0000000002777000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000003.1870495257.0000000002897000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000003.1879725536.00000000028B7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000003.1892234791.00000000026C7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001E.00000003.2288286803.0000000002917000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDB1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDAA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1709569323.000001AFCDAE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://litemanager.com/romversion.txt
Source: ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://litemanager.com/soft/pro/ROMServer.zip
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000009.00000003.1709569323.000001AFCDA56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 0442.pdf.exe

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FCC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF600FCC2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5511f4.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI186C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5511f7.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5511f7.msi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\5511f7.msi

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FEB190	0_2_00007FF600FEB190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE3484	0_2_00007FF600FE3484
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDA4AC	0_2_00007FF600FDA4AC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FCF930	0_2_00007FF600FCF930
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD4928	0_2_00007FF600FD4928
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF0754	0_2_00007FF600FF0754
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FECE88	0_2_00007FF600FECE88
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE1F20	0_2_00007FF600FE1F20
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FC5E24	0_2_00007FF600FC5E24
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD126C	0_2_00007FF600FD126C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FC7288	0_2_00007FF600FC7288
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FCC2F0	0_2_00007FF600FCC2F0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FCA310	0_2_00007FF600FCA310
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDF180	0_2_00007FF600FDF180
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE21D0	0_2_00007FF600FE21D0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDB534	0_2_00007FF600FDB534
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE53F0	0_2_00007FF600FE53F0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FC76C0	0_2_00007FF600FC76C0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF601002550	0_2_00007FF601002550
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FC4840	0_2_00007FF600FC4840
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FFC838	0_2_00007FF600FFC838
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD1A48	0_2_00007FF600FD1A48
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FFFA94	0_2_00007FF600FFFA94
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FC1AA4	0_2_00007FF600FC1AA4
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE2AB0	0_2_00007FF600FE2AB0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF601005AF8	0_2_00007FF601005AF8
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE3964	0_2_00007FF600FE3964
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDC96C	0_2_00007FF600FDC96C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF89A0	0_2_00007FF600FF89A0
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD5B60	0_2_00007FF600FD5B60
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDBB90	0_2_00007FF600FDBB90
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE4B98	0_2_00007FF600FE4B98
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF8C1C	0_2_00007FF600FF8C1C
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FDAF18	0_2_00007FF600FDAF18
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE2D58	0_2_00007FF600FE2D58
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FE8DF4	0_2_00007FF600FE8DF4
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF0754	0_2_00007FF600FF0754
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF601002080	0_2_00007FF601002080

Source: ROMViewer.exe.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe0.5.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: ROMServer.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMFUSClient.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMServer.exe0.5.dr	Static PE information: Number of sections : 11 > 10
Source: ROMViewer.exe.5.dr	Static PE information: Number of sections : 11 > 10

Source: ROMViewer.exe.5.dr

Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfmEditBinaryValue'

Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C894000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 0442.pdf.exe
Source: 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0442.pdf.exe

Source: classification engine

Classification label: mal88.troj.evad.winEXE@60/94@1/3

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FCB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF600FCB6D8

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FE8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF600FE8624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSLocal
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSTray

Source: C:\Users\user\Desktop\0442.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5573656

Jump to behavior

Source: Yara match	File source: 13.0.ROMServer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.ROMFUSClient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, type: DROPPED

Source: C:\Users\user\Desktop\0442.pdf.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "

Source: 0442.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\0442.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0442.pdf.exe	Virustotal: Detection: 47%
Source: 0442.pdf.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\0442.pdf.exe

File read: C:\Users\user\Desktop\0442.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0442.pdf.exe "C:\Users\user\Desktop\0442.pdf.exe"
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,18215150213972139035,17261459285525738276,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,18215150213972139035,17261459285525738276,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray

Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll

Source: C:\Users\user\Desktop\0442.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Start LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Uninstall LiteManager - Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Windows\SysWOW64\msiexec.exe
Source: Stop LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Settings for LM-Server.lnk.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0442.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0442.pdf.exe

Static file information: File size 11409543 > 1048576

Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0442.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0442.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0442.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0442.pdf.exe

Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0442.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0442.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5573656

Jump to behavior

Source: 0442.pdf.exe	Static PE information: section name: .didat
Source: 0442.pdf.exe	Static PE information: section name: _RDATA
Source: ROMViewer.exe.5.dr	Static PE information: section name: .didata
Source: ROMFUSClient.exe.5.dr	Static PE information: section name: .didata
Source: ROMwln.dll.5.dr	Static PE information: section name: .didata
Source: ROMServer.exe.5.dr	Static PE information: section name: .didata
Source: HookDrv.dll.5.dr	Static PE information: section name: .didata
Source: ROMServer.exe0.5.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF601005156 push rsi; retf		0_2_00007FF601005157
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF601005166 push rsi; retf		0_2_00007FF601005167

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\romserver.exe

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (132).png

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 0442.pdf.exe

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\LiteManager\v3.4\Server\Parameters NoIPSettings

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 2905
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 6863

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8628	Thread sleep count: 46 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8628	Thread sleep time: -230000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8536	Thread sleep count: 50 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 8812	Thread sleep time: -1452500s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 8812	Thread sleep time: -3431500s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FEB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF600FEB190
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FD40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF600FD40BC
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FFFCA0 FindFirstFileExA,	0_2_00007FF600FFFCA0

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FF16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF600FF16A4

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\winspool.drv
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	File opened: C:\Windows\SysWOW64\winmm.dll

Source: ROMFUSClient.exe, 00000019.00000002.1880989027.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: ROMFUSClient.exe, 00000010.00000002.1855010039.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.2935157808.000001AFCD851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2932704195.000001AFC822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ROMFUSClient.exe, 0000000E.00000003.1818158323.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ROMServer.exe, 00000012.00000002.2932096301.0000000000E98000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.2931991528.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2931989175.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000002.1852594027.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000002.1866692616.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000002.1871997145.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000002.1893623088.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001D.00000002.1974073612.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001E.00000002.2289898604.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001F.00000002.2417059111.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FF3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF600FF3170

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF601000D20 GetProcessHeap,

0_2_00007FF601000D20

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start

Jump to behavior

Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF600FF3170
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF600FF2510
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF3354 SetUnhandledExceptionFilter,	0_2_00007FF600FF3354
Source: C:\Users\user\Desktop\0442.pdf.exe	Code function: 0_2_00007FF600FF76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF600FF76D8

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FEB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF600FEB190

Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\0442.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.8.8	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF6010058E0 cpuid

0_2_00007FF6010058E0

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF600FEA2CC

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FF0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF600FF0754

Source: C:\Users\user\Desktop\0442.pdf.exe

Code function: 0_2_00007FF600FD51A4 GetVersionExW,

0_2_00007FF600FD51A4

Remote Access Functionality

Enables remote desktop connection

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server AllowRemoteRPC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Windows Service	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	222 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0442.pdf.exe	47%	Virustotal		Browse
0442.pdf.exe	26%	ReversingLabs	Win64.Trojan.Uztuby

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	8%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	3%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://litemanager.com/03	0%	Avira URL Cloud	safe
http://litemanager.com/1	0%	Avira URL Cloud	safe
http://litemanager.com/03w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.100	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://litemanager.com/1	ROMServer.exe, 00000012.00000002.2933625053.000000000176C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000288C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://litemanager.ru/	ROMFUSClient.exe, 0000000C.00000000.1788377420.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1794843487.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, Russian.lg.5.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000009.00000003.1709569323.000001AFCDB1A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://litemanager.com/soft/pro/ROMServer.zip	ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false		high
http://litemanager.com/03	ROMFUSClient.exe, 00000015.00000002.2933461192.0000000002893000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://litemanager.com/romversion.txt	ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	false		high
http://ocsp.thawte.com0	0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	false		high
http://litemanager.ru/noip.txtU	ROMServer.exe, 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2934887641.000001AFCD800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1709569323.000001AFCDAA3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1709569323.000001AFCDAE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://litemanager.com/	ROMFUSClient.exe, 0000000C.00000000.1788377420.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1794843487.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp, ROMServer.exe, 00000012.00000002.2933625053.000000000176C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000288C000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.000000000278C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://litemanager.com/03w	ROMServer.exe, 00000012.00000002.2933625053.0000000001773000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	ROMFUSClient.exe, 0000000C.00000003.1802761701.0000000002797000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000D.00000000.1792887318.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 0000000D.00000003.1796931420.0000000002A27000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000E.00000003.1817573851.0000000002787000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000F.00000003.1815885695.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000010.00000003.1852583819.00000000028C7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.1847150962.00000000029E7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.2933625053.00000000016D7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.2932912602.0000000002847000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.2933461192.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000003.1850601689.0000000002997000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000003.1859519529.0000000002777000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000003.1870495257.0000000002897000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000003.1879725536.00000000028B7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000003.1892234791.00000000026C7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001E.00000003.2288286803.0000000002917000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	0442.pdf.exe, 00000000.00000003.1676873311.000001A06C87A000.00000004.00000020.00020000.00000000.sdmp, 0442.pdf.exe, 00000000.00000003.1676873311.000001A06C83C000.00000004.00000020.00020000.00000000.sdmp, 5511f4.msi.5.dr, ms.msi.0.dr, 5511f7.msi.5.dr	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000009.00000003.1709569323.000001AFCDAC2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
101.99.91.150	unknown	Malaysia		45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580689
Start date and time:	2024-12-25 17:13:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0442.pdf.exe renamed because original name is a hash value
Original Sample Name:	.pdf.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@60/94@1/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 172.64.41.3, 162.159.61.3, 2.19.198.27, 23.32.239.65, 23.32.239.56, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 23.218.208.109, 23.195.39.65, 23.32.238.18, 23.32.238.74, 2.20.40.170, 104.122.212.204, 23.32.239.9, 2.19.198.16, 20.109.210.53, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Execution Graph export aborted for target ROMServer.exe, PID 8532 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:14:36	API Interceptor	2x Sleep call for process: svchost.exe modified
11:14:37	API Interceptor	1x Sleep call for process: Acrobat.exe modified
11:14:47	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
11:14:48	API Interceptor	17x Sleep call for process: ROMServer.exe modified
11:14:50	API Interceptor	35309x Sleep call for process: ROMFUSClient.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	#U5b89#U88c5#U7a0b#U5e8f_1.1.0.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	217.20.58.101
	#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	AxoPac.exe	Get hash	malicious	LummaC	Browse	217.20.58.100
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	217.20.58.99
	PLEASE SIGN THIS DOCUMENT - Reference number(s) 0598190575 DPR.msg	Get hash	malicious	Unknown	Browse	217.20.58.101
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	217.20.58.99
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	217.20.58.100
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	217.20.58.99
	data.exe	Get hash	malicious	Unknown	Browse	217.20.58.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	94e.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	94e.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	0442.pdf.exe	Get hash	malicious	Remcos	Browse	101.99.94.64
	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	101.99.92.189
	http://www.recorderkorea.com/shop/proc/indb.cart.tab.php?action=ok&tab=today&type=delete&returnUrl=https://23058.hicleanly.ca/uoeujd/shuhsdy/odog/kratos/REDIRECT/Zl2jyY/compliance@yourmom.com	Get hash	malicious	Unknown	Browse	101.99.81.34
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	101.99.75.174
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	101.99.75.174

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\5511f6.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	23984
Entropy (8bit):	5.167762278036821
Encrypted:	false
SSDEEP:	192:7mC7js8t8t+CqZ+6ySyDy6ylNbywyYylygy2fhWBiBNMBiBNvBiBNq5yoio2YUgF:7H75t8t+CqZ+cNbynfhzOj3IaygyVOVi
MD5:	801EABBC877CC4A4864139B5961F8142
SHA1:	A92BCB41C17CD45CEDE3EBEA4547D09CB60C03BE
SHA-256:	96561A23CBEFD5C6A3B09DCD1421D1BBE5000EF5799FC47E305C572E63B0A52C
SHA-512:	1034ED2C21D0821A003A680EB33EBA4010FF0E86E5CB5D51DDC272E5DBF57374AEB7046C2B14844372D4E21878B630233F712409CDA28186DFA0E96FC4DA9E9E
Malicious:	false
Preview:	...@IXOS.@.....@.Y.Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..ms.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3244CDE6-6414-4399-B0D5-424562747210}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{A3DC5A2F-2249-4674-BE

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132032
Entropy (8bit):	6.10195829980833
Encrypted:	false
SSDEEP:	3072:sh/1J7RYdzZU4Z5tegH1q888888888888W888888888882zgP:sh/jIZPZ5tJ8888888888888W888888s
MD5:	C40455A478E0B76521130D9DAAAADC4B
SHA1:	42DE923D5E36A9F56B002DD66DB245BC44480089
SHA-256:	308085BC357BF3A3BEE0D662FCC01628E9EE2FFD478AE0F1E7140939AD99B892
SHA-512:	76ED6D763F603BCAA7FE186C0A7449E614DCDB18036F7587C6E5A11C3F3269E400E3D2062856CC280AC20C094617924783B6C360F25AF66767DCC53C2F3045C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: gBYz86HSwI.msi, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....xK............................p........ ..........................................................................\.......\...............................x#...................................................................................text...$........................... ..`.itext.............................. ..`.data...0.... ......................@....bss....xN...@...........................idata..\...........................@....edata..\............&..............@..@.reloc..x#.......$...(..............@..B.rsrc................L..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default language ID 1049
Category:	dropped
Size (bytes):	58679
Entropy (8bit):	4.738446173390891
Encrypted:	false
SSDEEP:	768:bkJC7UF9eVWSlBY8Aq9CBGDtD8gX1ZDCZjewbAsCw1vPDQuJPQzusxxeCNHnPPsT:htwqueMZYU
MD5:	BAED4E7AF33F77350D454B69317EE63B
SHA1:	2B598774F0C73850A36117F29EA8DAC57BE1C138
SHA-256:	671D65183C39E53FC1759C45B105A0FBE2D3A216E4099B66D5FCF274EA625E07
SHA-512:	E740997BDECB8F907A000D01BF3E823898A1289D1DBFAE5BF342D4BCB6FF09D258317955F4FD858FF6B239E5BA08E49E90CDEC06E24DABDB18C1CF2D8943590C
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1251\uc1\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049{\fonttbl{\f0\froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f211\froman\fcharset0\fprq2 Times New Roman{\\falt Times New Roman};}..{\f209\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times New Roman};}{\f212\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times New Roman};}{\f213\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Times New Roman};}..{\f214\froman\fcharset177\fprq2 Times New Roman (Hebrew){\\falt Times New Roman};}{\f215\froman\fcharset178\fprq2 Time

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	89220
Entropy (8bit):	3.469297258214741
Encrypted:	false
SSDEEP:	768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
MD5:	B1C96EF24061BF294CAC6C4C9CBF7757
SHA1:	5D1B1934091E257B5F1C69B13F5FC1E424348584
SHA-256:	20DB884523DA62C20F80B8A3BB71E11091B90A443B83C06D8FE2A1BBC00C1C33
SHA-512:	6E90562FD804F91DDADEF2310551063D34B859FF1CC6E58A41667E9CDA062DCA851C8455882EF47CF3E1A8EC21EBD9F0761F15E54174CC4A95427238CB39BA14
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.3.3.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .Q.u.e.s.t.i.o.n.....e.r.r.o.r. .=. .E.r.r.o.r.....i.n.f.o.r.m.a.t.i.o.n. .=. .I.n.f.o.r.m.a.t.i.o.n.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .N.o.t.i.f.i.c.a.t.i.o.n.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .C.a.n. .n.o.t. .r.e.a.d. .s.e.r.v.i.c.e. .c.o.n.f.i.g.u.r.a.t.i.o.n...\.n.;.R.e.i.n.s.t.a.l.l. .L.i.t.e.M.a.n.a.g.e.r. .s.e.r.v.i.c.e.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e...\.n.;.R.e.b.o.o.t. .s.y.s.t.e.m.,. .p.l.e.a.s.e.......

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201728
Entropy (8bit):	6.3607488106285075
Encrypted:	false
SSDEEP:	3072:rmqdVRkbN1G3OKtVLqKc3IuQquARCASmShKJ:rmyTmNw3zqKcFLRs
MD5:	1D4F8CFC7BBF374CCC3AAE6045B2133D
SHA1:	802EDF0B0ED1D0305BCD6688EE3301366FEC1337
SHA-256:	C04885562F17BAEEFBCD2D4FC29F054EB8A66C44BD015750498C69A912D94C1F
SHA-512:	68643A30FEA87B2B61AF546F42BF32A25459152C1BCCE5A8A881714139CE828DFE4237874FF1E9CC3B78D6CDBEF7DD45C9F3459C3337D83693C704C274AFFF3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: gBYz86HSwI.msi, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse Filename: 0438.pdf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|..[.................\...........v............@.................................................................. ...................@...................@...G..................................................$................................text....S.......T.................. ..`.itext..D....p.......X.............. ..`.data...<............`..............@....bss....<Y...............................idata...............z..............@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc...G...@...H..................@..B.rsrc....@.......@..................@..@....................................@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	61034
Entropy (8bit):	4.429529654892776
Encrypted:	false
SSDEEP:	768:nebbtdP4XFsh6HWiIZTYp7JtMLG54ttg2kGPyWtvQTznCKDMlV2f:ne3KOhTTocL8HnMlV2f
MD5:	7303B5AE0B8911CEB238DC01419695BE
SHA1:	22B89BDB8FAEC62BA3E66639E38E6271B593944A
SHA-256:	88155FB3F0E198AA4A24F9CFECBB83C5A4E081C6EA362BC50294410CB2FB5C50
SHA-512:	8AE802616AF60BAF214E254F6A55D312DC46B6E3F8BEE5F50E30E372FF38103776278B5FB07A562C2149EEA58107CB427A03B1629F72044AB69D3507E5DFAB15
Malicious:	false
Preview:	[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.2.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .OUL.....e.r.r.o.r. .=. ./.......i.n.f.o.r.m.a.t.i.o.n. .=. ........n.o.t.i.f.i.c.a.t.i.o.n. .=. ....w....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .!q.l...S.g.RD}Ka.0\.n.;...e.[. .L.i.t.e.M.a.n.a.g.e.r. ..g.R?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0\.n.;....e.._j.\|q}.0....f.m._.s.e.t.t.i.n.g.s._.r.e.s.t.a.r.t._.s.e.r.v.i.c.e._.t.o._.a.p.p.l.y. .=. ....e_U.R .L.M. .:O.ghV.a(u.z._.NWY(u...f.0....f.m._.s.e.c.u.r.i.t.y._.f.o.r.c.e._.g.u.e.s.t. .=. .7_6R.O.(Wdk.\|q}.N-..[.....asTW.@b.g.}..O(u.....S.g.O.X[.S.kP..0 .!q.l.O(u.07_

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	58794
Entropy (8bit):	3.642324420313977
Encrypted:	false
SSDEEP:	768:D+XPobz4qFlRiiXc0HwgHSSxnrKT7nke7GShFBy/x97fuTLY57aC7I/Fj:yPQMw1ZOT7kef1y/X7fuTq4j
MD5:	606DC375E898D7221CCB7CEB8F7C686B
SHA1:	26DCF93876C89283623B8150C1B79EDB24B6A7EC
SHA-256:	F442E440580EA35040E35BF1D85A118E7C182FDE0B9BA2A3C1816DEAB5F822BB
SHA-512:	9FBC42165B51A2020D2DA2FFE33287A4F3AA33639126813B290D329D47C4F4DA8F297A47AF3C1F63AF6F9E1BA47ACE840BC1660D603E17589E5DB6DDA0E1E5B1
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.5.5.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .S.o.r.u.....e.r.r.o.r. .=. .H.a.t.a.....i.n.f.o.r.m.a.t.i.o.n. .=. .B.i.l.g.i.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .B.i.l.d.i.r.i.m.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .H.i.z.m.e.t. .y.a.p.1.l.a.n.d.1.r.m.a.s.1. .o.k.u.n.a.m.1.y.o.r...\.n.;.L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t.i.n.i. .y.e.n.i.d.e.n. .y...k.l.e.m.e.k. .m.i. .i.s.t.i.y.o.r.s.u.n.u.z.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r...\.n.;.S.i.s.t.e.m.i. .y.e.n.i.d.e.n. .b.a._.l.

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (305), with CRLF line terminators
Category:	dropped
Size (bytes):	87912
Entropy (8bit):	4.303374267443204
Encrypted:	false
SSDEEP:	768:VUlHxa/yEOYEJNHWjlUu1pZ26ER2nkUTbfk74Q:aNxWREb4lUu1P29R2JbfC4Q
MD5:	3FC082E8F516EAD9FC26AC01E737F9EF
SHA1:	3B67EBCE4400DDCF6B228E5668F3008561FB8F21
SHA-256:	3DC0CEAE11F445B57B17B7C35A90B5133E313CF6B61550AB418252C5B8089C99
SHA-512:	9A9D20AF2F8C27056F58AB5A9C687F5124CE5F6D563E396C9558331FB8BE48E88E148B1FDC548A5EBDEDB451E3D89F2F96856F3BBFD695691D5687599F376421
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d. .=. .1.0.5.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...8.B.0.=.=.O.....e.r.r.o.r. .=. ...>.<.8.;.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.V.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...>.2.V.4.>.<.;.5.=.=.O.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.<.>.6.;.8.2.>. .?.@.>.G.8.B.0.B.8. .:.>.=.D.V.3.C.@.0.F.V.N. .A.;.C.6.1.8...\.n.;...5.@.5.2.A.B.0.=.>.2.8.B.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6307408
Entropy (8bit):	6.5944937257467116
Encrypted:	false
SSDEEP:	98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
MD5:	63D0964168B927D00064AA684E79A300
SHA1:	B4B9B0E3D92E8A3CBE0A95221B5512DED14EFB64
SHA-256:	33D1A34FEC88CE59BEB756F5A274FF451CAF171A755AAE12B047E678929E8023
SHA-512:	894D8A25E9DB3165E0DAAE521F36BBD6F9575D4F46A2597D13DEC8612705634EFEA636A3C4165BA1F7CA3CDC4DC7D4542D0EA9987DE10D2BC5A6ED9D6E05AECB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................C..F........C.......C...@.......................... i.......`..........@................... N.......M..A...@T...............`.P"...PN.<............................@N.......................M.......N......................text.....C.......C................. ..`.itext...0....C..2....C............. ..`.data... 3....C..4....C.............@....bss........0E..........................idata...A....M..B....E.............@....didata.......N......LE.............@....edata....... N......ZE.............@..@.tls....X....0N..........................rdata..]....@N......\E.............@..@.reloc..<....PN......^E.............@..B.rsrc........@T......DK.............@..@............. i.......`.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7753808
Entropy (8bit):	6.615075046955521
Encrypted:	false
SSDEEP:	98304:D4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCAFIqOx9N:DXQ7SIEXeMBk2V4N/Nq2Iqw9N
MD5:	F3D74B072B9697CF64B0B8445FDC8128
SHA1:	8408DA5AF9F257D12A8B8C93914614E9E725F54C
SHA-256:	70186F0710D1402371CE2E6194B03D8A153443CEA5DDB9FC57E7433CCE96AE02
SHA-512:	004054EF8CDB9E2FEFC3B7783574BFF57D6D5BF9A4624AD88CB7ECCAE29D4DFD2240A0DC60A14480E6722657132082332A3EC3A7C49D37437644A31E59F551AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w#.f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g.. ............v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.... ....g.. ....^.............@..@............. ........v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	999944
Entropy (8bit):	6.626732213066839
Encrypted:	false
SSDEEP:	12288:SA9+TVJdg0YMgqAahyv0jKdTq4lrBhqSq/rt8VwGFrt:SRho0lgqA6yvnrBhq/rQDt
MD5:	ED32E23322D816C3FE2FC3D05972689E
SHA1:	5EEA702C9F2AC0A1AADAE25B09E7983DA8C82344
SHA-256:	7F33398B98E225F56CD287060BEFF6773ABB92404AFC21436B0A20124919FE05
SHA-512:	E505265DD9D88B3199EB0D4B7D8B81B2F4577FABD4271B3C286366F3C1A58479B4DC40CCB8F0045C7CD08FD8BF198029345EEF9D2D2407306B73E5957AD59EDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...`.-\.................J...........X.......`....@.................................................................. ...................@...........0.......@.. O...................................................................................text...0?.......@.................. ..`.itext..8....P.......D.............. ..`.data....:...`...<...N..............@....bss.....]...............................idata..............................@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc.. O...@...P..................@..B.rsrc....@.......@..................@..@.....................0..............@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	94772
Entropy (8bit):	4.284840986247552
Encrypted:	false
SSDEEP:	768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
MD5:	0E204FABE68B4B65ED5E0834651FB732
SHA1:	B338A6E54AA18F3F8A573580520F16C74A51F3D2
SHA-256:	302373D81F0AE15589206420CB01A266804C9FD1C1FF0D6E09CE6BA3FEF92B64
SHA-512:	AAD76F6A76DC693D959389CE471BC585D0DA72737FED99F42F219FDC7C71617C00E8003A467092E12820A359D672C6FB80D99772F3F6433923B2ABB7EEA40F08
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.4.9.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...>.?.@.>.A.....e.r.r.o.r. .=. ...H.8.1.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.8.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...?.>.2.5.I.5.=.8.5.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.2.>.7.<.>.6.=.>. .?.@.>.G.8.B.0.B.L. .:.>.=.D.8.3.C.@.0.F.8.N. .A.;.C.6.1.K...\.n.;...5.@.5.C.A.B.0.=.>.2.8.B.L. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r...\.n.

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7752272
Entropy (8bit):	6.615186281886958
Encrypted:	false
SSDEEP:	98304:y4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOxJn:yXQ7SIEXeMBk2V4N/NqiIqwJn
MD5:	84FB34E529BEDE393A3F604EAA8137B2
SHA1:	195EA03B7BD086454A13C0D8357E0A9E447D9EC9
SHA-256:	1E396C4066AC8F421A54893442A0D76C4F8D4146E63825D67DFC0DA782E73EE5
SHA-512:	A48A80D62E588667B4C891CDED279BABFFA5FB4FDF092F345212F81D29A9ACAA06E6DB27B49DC601909409A3C82AA9272BCDF90D0AE1738E83E80D9FCA4D93E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g..............(v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.........g.......^.............@..@............. .......(v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11361360
Entropy (8bit):	6.496049600782297
Encrypted:	false
SSDEEP:	98304:AshiRp5hPI7N9sSA5wbZXJOu/0uOXZYfmQYanSjS+cWuNOlQpgfYLyPsd+QgBBP5:Al5hPwgvyAjDjS+igfgym+bHJxmK
MD5:	B0E355EC3453C8FFAEE08CD4257E96F2
SHA1:	0FA023CA8F1C1ECDADDE3DD3BD551870C2D965E2
SHA-256:	60248BA026064B116E4F94020DABB74DF519F5B4C41379CA19A38D725692CA8E
SHA-512:	B6004F83FD78EED84BF21611EFA45F2FFADF3625E0A2FDCDAE531B4734A4B886EBFE5EBE990DA42302B7368282D83DFFEF19E71DA8EC4C155EE5C8619AD028DD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................v..67.......v...... v...@..........................0...................@...................p...........L...p....+..........:..P"...................................................................`.......................text.....u.......u................. ..`.itext...6....u..8....u............. ..`.data....R... v..T....v.............@....bss.........w..........................idata...L.......N...Xw.............@....didata......`........w.............@....edata.......p........w.............@..@.tls....`................................rdata..].............w.............@..@.reloc................w.............@..B.rsrc.....+..p....+.................@..@.............0.......:..............@..@................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073755891648744
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrX:KooCEYhgYEL0In
MD5:	71830F913302C2DB09092A5913F94F6C
SHA1:	F7A159462F701FE20E1BC586C4CD3899D5CD9013
SHA-256:	BA23DD41D289D48761ACA03E12A2517D32615CEF0AB9F6C2CFFB73885DEB91A6
SHA-512:	D39D845F051D6C13FFB6400C81C94B69D8ACA6A0D2EA8812391FEA7C9A608260FB857F772869C5313380EFEBC3DA21AB1A7A7CD79103BCF57B6D8EE69A9EB99B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x87827848, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422196023988347
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	B7D11B4DDF7186F1361CBEAE1A42EBED
SHA1:	0CF7128209AB98B36B4BDD4698A45F2AE88578B5
SHA-256:	611587943F427AEC695778C94987F8A6B4829C5D874CFA5BE04600DFEF54B582
SHA-512:	09594A202B10C80BB7BD40F3D8697D9897A1ADCC11DEECE5F6A4853EA56F55421B2BFD3EE1E7484D0DB7688CB56548FEF4EEDD4B5250F342386D9BF594A13D49
Malicious:	false
Preview:	..xH... .......A.......X\...;...{......................0.!..........{A.%....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................Z.Y.&....\|u.....................%....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07710859733589415
Encrypted:	false
SSDEEP:	3:0lll/KYe3q/jjn13a/Sr1UKallcVO/lnlZMxZNQl:Ul/Kz3q/j53qSr2bOewk
MD5:	D3930364474B1BE900A9F2F3D0CA5DD4
SHA1:	022BEFA8CBD776B5F00153205B01F900320465F4
SHA-256:	04ADFD8AEC2CBE281E0EDF4102A9A94AB297694474E93651FDE434AB9B8E2053
SHA-512:	7CC597C663BA39A34B95E5B7542001FB86B5E93214018079C7F786BED0FD2F64D88FDDDAC3FEAD3DEC15A94FA4B8808691CBAB8043BAD7FF61D30ABAFA4C99E0
Malicious:	false
Preview:	.........................................;...{..%....\|.......{A..............{A......{A..........{A]....................%....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 18:41:10 2024, mtime=Wed Dec 25 15:14:42 2024, atime=Thu Aug 22 18:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	3.925761772599664
Encrypted:	false
SSDEEP:	48:8H2hbdcdOUjEvA8Zd5Y+d5YsP5qoZkmrSUp8JWqoZkmtU:8HhjEa9O5qoZbcJWqoZbt
MD5:	488734A3F3B9256252191EAD105E1F43
SHA1:	EA6EF01D2129ED8C365749F3B0AC21BFCEB293D0
SHA-256:	E16AB58F1A94104645F45E4EA17F485DB8D533C0A48B1B4B5C204D263F9867FD
SHA-512:	52393E836ECBFDEABD817A3B96DA115BC819CCC29C88CDC5B02095A1F542EA9AC29330827C8B8F51BA106E0B9C6279711D1770D819303A905A6A51600334F0B3
Malicious:	false
Preview:	L..................F.@.. ......=.........V.....=....PPv..........................P.O. .:i.....+00.../C:\.....................1......Y...PROGRA~2.........O.I.Y.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1......Y...LITEMA~1..b......Y..Y....."......................f..L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%..Y...............................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k.............A&.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.c.o.n.f.i.g.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	3.1573107695942624
Encrypted:	false
SSDEEP:	48:8ddOEPLqd5Y+d5YcCP5q2DT2S0Wq2DTKX7:85LJ9cM5qUoWqUE
MD5:	5FC67E19699B3F0B2AB7B4B89B0B3F1A
SHA1:	6F6380DF2EB8C5D30452A846864F001A8B0E473A
SHA-256:	45451F933B472FA53301D46B7C072AF67E51EC60172E6E9C01E0B308DF78A2F4
SHA-512:	81C7A9F5683DB54893BD26A6EC1BCBDB17983037668CD996E03934E7708331594195DBF2CCE9EB2B0C0567A9E8B24DD629D40866D49E55C9DF77A864D15744E5
Malicious:	false
Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)..."...1...........LiteManager Pro - Server..b............................................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r...(.h.2...........ROMServer.exe.L............................................R.O.M.S.e.r.v.e.r...e.x.e.......L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.a.r.t.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.R.O.M.S.e.r.v.e.r...e.x.e._.9.D.0.9.B.2.B.C.2.5.A.2.4.1.4.C.B.D.8.4.8.E.2.B.7.5.8.9.8.6.7.6...e.x.e.........%SystemRoot%\In

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 18:41:10 2024, mtime=Wed Dec 25 15:14:42 2024, atime=Thu Aug 22 18:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	3.912902825693082
Encrypted:	false
SSDEEP:	48:8r2hbdcdOXtMxA8Zd5Y+d5Ys5qcxFWT84SslWqcxFWT8cU:8r6m09s5qcxYT8SWqcxYT8c
MD5:	D6AA259CEC95A50CD6FE93C763B64AE0
SHA1:	A59F0E4A74E1271F1E2992B1CB67C82347B2C566
SHA-256:	DA0C589CDFB183F7B0B76BC1AE52CF9C71CF0251D3CE97BC93EF5FF4DAB560F9
SHA-512:	10EA4C233BF080772A0F78C371DD55C4E152C3EA7B90D378F85E278BF3C2199517BA7EB16E7B994EDFAE5F4554D67D5ABE715F1F57D91A2A818647C3D377A4E2
Malicious:	false
Preview:	L..................F.@.. ......=....D....V.....=....PPv..........................P.O. .:i.....+00.../C:\.....................1......Y...PROGRA~2.........O.I.Y.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1......Y...LITEMA~1..b......Y..Y.....".......................#.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%..Y...............................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k.............A&.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.o.p.l.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.s.t

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Oct 4 09:56:56 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	3.877241331767932
Encrypted:	false
SSDEEP:	24:8WnJ+Ds3lBbTAaPwB+sHyjv/+MTyjvejIKZDUHwGS7ke4WTyjvejIKZDUHwwcnIL:8WnuiBb0FHOn5qmjlt6ScWqmjltZV
MD5:	9DB1346A93911F4C088C5D1F88847228
SHA1:	10E961AB4D2BDD742A68AE00F64B471ABB52D92F
SHA-256:	648BA39BA79CC5BB5B357B62703E56FD3D82E4859516C93EDDBF2177D2E857D1
SHA-512:	9927E257A3B97D0CCF3FF7E562A618237B858CB7522FC382857EA4F4C81A380569B8B7F70202B4350F0B72C8B3AC5E619CEAC400FFF6036AEDF3D264BBBA3AE4
Malicious:	false
Preview:	L..................F.@.. ...25.....1>.~....25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.Y.....3.....................z.i.W.i.n.d.o.w.s.....Z.1......Y...SysWOW64..B......O.I.Y.....Y.......................K.S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBIDW.V................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M.............A&.....C:\Windows\SysWOW64\msiexec.exe........\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.s.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.U.N.I.N.S.T._.U.n.i.n.s.t.a.l.l._.L._.7.8.A.A.5.B.6.6.6.2.5.1.4.D.9.4.A.8.4.7.D.6.C.6.0.3.A.F.0.8.9.5...e.x.e.........%SystemRoot%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C6

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2510377978189355
Encrypted:	false
SSDEEP:	6:F+JdS3cM+q2Pwkn2nKuAl9OmbnIFUt8K+mJZmw+K+iMw3cMVkwOwkn2nKuAl9Omt:MJWcM+vYfHAahFUt8/mJ/+/g3cMV5JfC
MD5:	76DFBDFEAD41FB27C81866E5FC42E4E2
SHA1:	459DA43C3BE6F88FE28B784BA4C41C7C83EE159D
SHA-256:	A19E53EF5BA2B2AE78C2E65ACED2A23936E50BC2998DC18F0F1E259EE51CB51C
SHA-512:	D200694261A69ECF56CC4981338E29A6F81962D8CCFFB572B8F46224B8F739730957999EC0E6AC33D541DF265F8ADB60945F694B75EE7B6C9D1D214C6A816436
Malicious:	false
Preview:	2024/12/25-11:14:36.517 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/25-11:14:36.519 1f8c Recovering log #3.2024/12/25-11:14:36.520 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2510377978189355
Encrypted:	false
SSDEEP:	6:F+JdS3cM+q2Pwkn2nKuAl9OmbnIFUt8K+mJZmw+K+iMw3cMVkwOwkn2nKuAl9Omt:MJWcM+vYfHAahFUt8/mJ/+/g3cMV5JfC
MD5:	76DFBDFEAD41FB27C81866E5FC42E4E2
SHA1:	459DA43C3BE6F88FE28B784BA4C41C7C83EE159D
SHA-256:	A19E53EF5BA2B2AE78C2E65ACED2A23936E50BC2998DC18F0F1E259EE51CB51C
SHA-512:	D200694261A69ECF56CC4981338E29A6F81962D8CCFFB572B8F46224B8F739730957999EC0E6AC33D541DF265F8ADB60945F694B75EE7B6C9D1D214C6A816436
Malicious:	false
Preview:	2024/12/25-11:14:36.517 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/25-11:14:36.519 1f8c Recovering log #3.2024/12/25-11:14:36.520 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.201834281159893
Encrypted:	false
SSDEEP:	6:F+oQq2Pwkn2nKuAl9Ombzo2jMGIFUt8K+owZmw+K+oFkwOwkn2nKuAl9Ombzo2jz:MoQvYfHAa8uFUt8/ow/+/oF5JfHAa8RJ
MD5:	A5074AFE11AF599A53D87E77C350A7D7
SHA1:	3A8929570D7924B5A12A9D182F74FCF603CFCA7F
SHA-256:	8D522C840B839E9248DFA5109A20E8DA80D3ACC144D4CAFC7284C89FFEFEB79A
SHA-512:	735E928A88E5D3336DC6C5DBE4265148321E522FF9D1141FBEBE7DB8F7F83752FAB0CA1156F22F42507DFFBFE3D985AA340AABDE4A4FBA1FE95C62469A3E0F3C
Malicious:	false
Preview:	2024/12/25-11:14:36.580 d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/25-11:14:36.581 d04 Recovering log #3.2024/12/25-11:14:36.582 d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.201834281159893
Encrypted:	false
SSDEEP:	6:F+oQq2Pwkn2nKuAl9Ombzo2jMGIFUt8K+owZmw+K+oFkwOwkn2nKuAl9Ombzo2jz:MoQvYfHAa8uFUt8/ow/+/oF5JfHAa8RJ
MD5:	A5074AFE11AF599A53D87E77C350A7D7
SHA1:	3A8929570D7924B5A12A9D182F74FCF603CFCA7F
SHA-256:	8D522C840B839E9248DFA5109A20E8DA80D3ACC144D4CAFC7284C89FFEFEB79A
SHA-512:	735E928A88E5D3336DC6C5DBE4265148321E522FF9D1141FBEBE7DB8F7F83752FAB0CA1156F22F42507DFFBFE3D985AA340AABDE4A4FBA1FE95C62469A3E0F3C
Malicious:	false
Preview:	2024/12/25-11:14:36.580 d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/25-11:14:36.581 d04 Recovering log #3.2024/12/25-11:14:36.582 d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0fe15e5b-3651-46cf-9556-d1f73fb4796a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97540442432775
Encrypted:	false
SSDEEP:	12:YH/um3RA8squsBdOg2HHAAcaq3QYiubInP7E4TX:Y2sRdsmdMHHg3QYhbG7n7
MD5:	DB68BDC532BE871C485FE5625F8D72E2
SHA1:	4F5523EF139BD6CEB51B4A8C49571272971E8D2C
SHA-256:	254389855F88B73E951D6A3BD16224C83B55FF703AD95EE6E2054640CA7C167A
SHA-512:	C65870888BADFFCE531E50F328DC9E352420ABBF9E98425131E4F06F9EE9F5BBD24FFA61E4BFAD66BF0418FF633D291F95633A415053809AD1C241C3FA1A0504
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379703284908020","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":684151},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\60d3fbaf-400c-4d13-a42e-76aff343a0ee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF564738.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4TX:Y2sRdsVdMHO3QYhbG7n7
MD5:	B7761633048D74E3C02F61AD04E00147
SHA1:	72A2D446DF757BAEA2C7A58C050925976E4C9372
SHA-256:	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
SHA-512:	397A10C510FAA048E4AAB08A11B2AE14A09EE47EC4F5A2B47CE1A9580C2874ADE0F9F8FC287B9358C0FFEA4C89F8AB9270B9CA00064EA90CD2EF0EAD0A59369F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.251333704953413
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7p7s:etJCV4FiN/jTN/2r8Mta02fEhgO73goW
MD5:	9409F0548ECFB5D821AC3993FBA23E22
SHA1:	4A0826B1B4453C98F2F496464A4EEB20176B27FF
SHA-256:	24F93600E4F385E01D4AFFE4835A4C778F3251015B1CF5841AACDB0E148A4981
SHA-512:	5EFB45FFF68A4571F1E5325D2F19880440DB92D9C083E6388C4B63C9FA6C8EA9B2DAED72D199722FBAEF33915EB372DF605A4958A87D11A39E095CBA4571B858
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.226539446058056
Encrypted:	false
SSDEEP:	6:F+A4q2Pwkn2nKuAl9OmbzNMxIFUt8K+5pZmw+K+TtFkwOwkn2nKuAl9OmbzNMFLJ:MA4vYfHAa8jFUt8/z/+/TtF5JfHAa84J
MD5:	43FE4BFD0A5D9CA08FF8DFC41F0DA353
SHA1:	6748CA878A832B60C045359EBFE2B7B1C456B6DD
SHA-256:	822B8514FCD1FB8368165F75B2F8C38A5D46109EC8DBCB7BA612F25AC4716B8E
SHA-512:	4A8CB4BC7A00B929E71EA8ED5FD7329C0FC9C748B78A5DCDDB8992C344D3910617531458C77F95F1A01A54645693D0419CB3817FD02B42FAD5BDA4624213EC7A
Malicious:	false
Preview:	2024/12/25-11:14:36.768 d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/25-11:14:36.770 d04 Recovering log #3.2024/12/25-11:14:36.772 d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.226539446058056
Encrypted:	false
SSDEEP:	6:F+A4q2Pwkn2nKuAl9OmbzNMxIFUt8K+5pZmw+K+TtFkwOwkn2nKuAl9OmbzNMFLJ:MA4vYfHAa8jFUt8/z/+/TtF5JfHAa84J
MD5:	43FE4BFD0A5D9CA08FF8DFC41F0DA353
SHA1:	6748CA878A832B60C045359EBFE2B7B1C456B6DD
SHA-256:	822B8514FCD1FB8368165F75B2F8C38A5D46109EC8DBCB7BA612F25AC4716B8E
SHA-512:	4A8CB4BC7A00B929E71EA8ED5FD7329C0FC9C748B78A5DCDDB8992C344D3910617531458C77F95F1A01A54645693D0419CB3817FD02B42FAD5BDA4624213EC7A
Malicious:	false
Preview:	2024/12/25-11:14:36.768 d04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/25-11:14:36.770 d04 Recovering log #3.2024/12/25-11:14:36.772 d04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4452931025648725
Encrypted:	false
SSDEEP:	384:yezci5tYiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r/s3OazzU89UTTgUL
MD5:	73BFE3056E3214C37F3CA39861DC41EE
SHA1:	B68F6EAFAB72A04751698F56DCD1A9670BCCE6CE
SHA-256:	22783BC48B8017F917734362468403805525594D5534B75D39CB04E9640A6434
SHA-512:	8A30A67D5E92651386846233673058E3C95A21A5B25977539F4625D1239714CCF37F672EBB7C526CC82E27C62C2AB65612C2EA37A94D7627033F9535E79E2264
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7774892429030436
Encrypted:	false
SSDEEP:	48:7MGp/E2ioyVxQioy9oWoy1Cwoy1GTKOioy1noy1AYoy1Wioy1hioybioykloy1nN:7FpjuiFpXKQFQb9IVXEBodRBkq
MD5:	2FF407DBF50B458863C40BC0E4A46DDE
SHA1:	8DF2FF7294C2D9F9700873E830304490F725FA7A
SHA-256:	98B742D3C19D8CF5080FD0D0946EB2F0A1943B695DDEC5DCCE32BCAA4BFCBD19
SHA-512:	64168A8211AF287B22F5C48E3B44E54896002CE0FE79F7C463671E4DF29993F793738FA2561A3232C021DF7C29B6AD0AB46EE51C0A50701571F838E045250106
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7464849065063075
Encrypted:	false
SSDEEP:	3:kkFklkNoNdttfllXlE/HT8kyI/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kK9NQ/eT8MJ7NMa8RdWBwRd
MD5:	A52BDE16DFC3FDA1DB08983A3BDD3235
SHA1:	C4BF6F33F5E0DE14CCBD7BC6F8D2507532F8C694
SHA-256:	A4D58FC0925E481380CF0830BFF6C19C306542116B08AD90F1B12E82AE786C92
SHA-512:	76BD8FD1340681760384A2FC6867495C6734442B353890FF098240CB8C8B82C99F2B20B98C215D88FFB86D254D3D5B16C600CBB90B649DC725215044BC809B3A
Malicious:	false
Preview:	p...... ........Wh...V..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1224298822818697
Encrypted:	false
SSDEEP:	6:kK5X3/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:RnaDnLNkPlE99SNxAhUe/3
MD5:	7E8DB912B4320C8145ABE6FCE981B3FD
SHA1:	392B3E7DF7E9731F7B39B3DBDA41476D284B3055
SHA-256:	473E5E39C1AF8740CB9C6AFFB9268CE258F1776A48419930C7DB2F8333AC88D5
SHA-512:	8B2999ABF1899A60DCBB4E54F7DD9525CF83BD8A606539261668EB9DA1C7B4C2639C0F2692B92CA4CDF0F156E8FDFF7E35FF326A138899B088EF893D6D4F6255
Malicious:	false
Preview:	p...... ........7..1.V..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372229577935186
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJM3g98kUwPeUkwRe9:YvXKXyPgZc0vdsGMbLUkee9
MD5:	F54E9FF0B604F1D07FDA3C4CA5911B0D
SHA1:	5CAC5F3CF28E054705F6267F42E7FF5FAB035ED4
SHA-256:	BCC21CCBC9C6E4FCF9DC12FF4FC7D262232139C2257626BAC76CD88296B2A830
SHA-512:	0EAD348514D03B77FA6353B9DBBBDF675F4A65256A580886A9112183E39D5004FD2491E2335A047D4F4A1D09EB34A493F6A818CC47F99B62B9102820DA5786FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321550926951569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfBoTfXpnrPeUkwRe9:YvXKXyPgZc0vdsGWTfXcUkee9
MD5:	363D6D370EE646336DB5ABA793670DF0
SHA1:	12E31B7045054DC08A3BFF20FB58BDA70E16C56C
SHA-256:	8BA344BFE553A52945070D9B6C99D8B84AB30FF605C7FF3D55114135B5209D4E
SHA-512:	4E05C5D0AF3FC7BF945F01D64573845165AC902F9EA7AF4A3BDA842E252BEFB80EB3EB0D5410734DDEABC4D123620A2BAFEBBB477BBF571B62D53C1BA99B7742
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300818720866238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfBD2G6UpnrPeUkwRe9:YvXKXyPgZc0vdsGR22cUkee9
MD5:	3635ACF8D903BF590F65B9519019132B
SHA1:	16EDABDF64DF20896AC3C4FF7B5C5F441DBB301B
SHA-256:	13A943E0FA205DD8EB2D31BA53F851E4D2D1794EA4C36A856252B9C0BEAEE995
SHA-512:	76F5BF974615D5903A67B81B8D71EFCF9FF8518E7381C32909D09040364A1BF271EA3C6106D89A40137B59DC17D602C359BFB7CA5D5ADB68858D1CED80EFD4A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359551178573081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfPmwrPeUkwRe9:YvXKXyPgZc0vdsGH56Ukee9
MD5:	1BC4E7CF0FC1A0B79E3D67A98DC07C4F
SHA1:	A8A6BAB71A0B4A2ACE03A71909082FED6B80C6ED
SHA-256:	B004804464CF3A55C47B9338E7BA6D93C76E640A4A932CB1CD97EBF32AA42CAD
SHA-512:	43488FDF998974FF3226F37FBECCD407BC9440A827F690254F72645EC07E9374705A8B5784506EF583139DF9B56BD5ACEE0B20EE4B486E189D23A7BE0B9AF252
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690129059461412
Encrypted:	false
SSDEEP:	24:Yv6XegzvHpLgE9cQx8LennAvzBvkn0RCmK8czOCCSrr:Yv4vhgy6SAFv5Ah8cv/v
MD5:	904EFC9A9847562F053CC2731F7081D7
SHA1:	D29E905F8472DB00785C2B15EAAA91253B8CDAEE
SHA-256:	CC304E803ECEE870D6F1079B30DE3831237ABE7445619F7266BF739550CC18D9
SHA-512:	1D28DC52974864F680A8D043579EFE56FF8A4F62D56E27F8FBA5697D02968765879483F98F5DA219ABE3CF082FE4C4F58AF3B947BD765C1D5C9408E506503BBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306639093417557
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJf8dPeUkwRe9:YvXKXyPgZc0vdsGU8Ukee9
MD5:	91CC55112F9A976DC06D0BE25C0578AC
SHA1:	DBD7054A9E5B8286471D94F031597837626EFCC2
SHA-256:	55B94C7C2143DDE90AA7AF1E12BC99226B954C519E2E685C64F05D6C609C000C
SHA-512:	83EE8B68B90F21F88927723122F4B7D5B0745B627273139EAD3BE2A4BD391DDAD1AD65AF4AAEC443184298C57050B6BCF5C95835394B4FDA8DFEA61AE6F3461D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.309887895067931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfQ1rPeUkwRe9:YvXKXyPgZc0vdsGY16Ukee9
MD5:	4292CD79C97988DABB84B0FD6800881B
SHA1:	2E550C77BB6D649B6BCC04C587D32F40A1D57062
SHA-256:	89169085309FB27BDAA4B3F671F1F12ACEC35061CD44E361BD556DA9DBD0F6F3
SHA-512:	A3416210ED7246C172DB61CDB7108DF38429D6591F3B00502D181B4E3B74B77A99E3048EEFFA4D0047724F08206066EF5FE4F538CE243758142A6A5DF699922E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31644730943071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfFldPeUkwRe9:YvXKXyPgZc0vdsGz8Ukee9
MD5:	094789BC56592EC5D8819198817F67B3
SHA1:	DBCD5CBBD73CD248D06C52280CFE4E2601212958
SHA-256:	3BD3673084F08E280421B1985414ED025CDF96312F6E801F80C79FF4AF1C700D
SHA-512:	FC59FE288027CCB5D9DF667DF5F81DC9067679580B68B7C3792CDDB593F695CC5990EFF4481C2258B1CB389E41ACBE4CE15B59EA3E1D4F53D6585CB52C843962
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331549343500284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfzdPeUkwRe9:YvXKXyPgZc0vdsGb8Ukee9
MD5:	436DF9BD60E217F5C017004DB77378B0
SHA1:	5829E936BB75CD6035D57DF07646C587827D85E6
SHA-256:	841BD1F482E6FFD02B48D4044386B7EBD4707B2A124C3FFEE8476A041447B9EA
SHA-512:	F47925C84721A74DF034AAAB6758CF48EA61B951EE52775AE3F5A69A3A4714992C7376BD82AB07E8A7E15CF1C74803137A212AFD882C3A4B72237ACD4FDD6FED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312152258979992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfYdPeUkwRe9:YvXKXyPgZc0vdsGg8Ukee9
MD5:	7AE97B42A3932426C5F0EC61554DF1AD
SHA1:	72780104807A253F680617AB3DC9D034D1C7F44E
SHA-256:	1F621F662DDBE4BE1922FA07CE05415064B9766D17F430E9C9D2D48057924297
SHA-512:	F194A45D7B68BC520A6AC9727B1E6E85B7730216EECFE38692656C3433DFAFBAE97E834D6D49FAAE61409B1236137BF4311CD731110D85FC448DE7A32F91800D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.298997933644804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJf+dPeUkwRe9:YvXKXyPgZc0vdsG28Ukee9
MD5:	58C1BFBAF209547E353AE72039E98657
SHA1:	F039021B6DD34343D6CB384FC8B5381EB2936F9D
SHA-256:	2960F5EA246DB8CBC4EECC75CAA089224C05CA13D981A66456E7626EC1D21717
SHA-512:	18F74F1D0599CAFF65498E1BF38367AD03FE3CC6FB5F783E4F5C8940D9E6766BB9AF4BA6925C3EE1B795F9D11FA40746900C628C3CE7A3E21928BEA027EB727F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295615835973581
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfbPtdPeUkwRe9:YvXKXyPgZc0vdsGDV8Ukee9
MD5:	8838098BEC36716755E5DB1B37209AC3
SHA1:	4D6690A048383B6155F853EDBFA1599053B05185
SHA-256:	3689DEFBE1C0CF381D5AE092A12F4C4A9C13736248EC955D26775A53C7EE473B
SHA-512:	AC09972447473F437D397DAEDAB81796D2AFC27DC12FA43F1BA7DE0935C9C393EAB900A3DDFC9E9CF88EF9D09B6980EF3F8840B65A90859302B843ADF26C5CAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.300121113410555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJf21rPeUkwRe9:YvXKXyPgZc0vdsG+16Ukee9
MD5:	7814516CB36A17180179BCD644CA52AF
SHA1:	A9C5BFCB386A5234432B13959C84F9F0E97AAC8F
SHA-256:	1D3DECE24401BAC614CADE414929BBB6FE3CDA30B38DBBF0F7C7C3B5CB04E184
SHA-512:	B1C88DDD32DC8FD9105EB1F4ACA030F2FDDEB943AD93826C26D0F2DC9F1088DF07F0C2C69F1DF0CEAFD3ECFEA0B8315B7E6AAD928B5BF79F21C98A104D36CEFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665969928694139
Encrypted:	false
SSDEEP:	24:Yv6Xegzv/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSrr:Yv4PBgkDMUJUAh8cvMv
MD5:	0480978F512006EDF4D6D83EFCC72A3E
SHA1:	75A7EA134A385E3CD134A238E928849AC31016F6
SHA-256:	959264A454CA3EEE69E4CFFB5C13D1D0CE83A7841A66655F1673A3729F177153
SHA-512:	0058CE421802FE19A7888E51FFA53757C54D3806316922075F201D9AD7D1B1DCCD9D8C8384A7E3ED2F69BA0959735033B64ED77A78855155DCE4A2BF64C6258A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.277415728127787
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJfshHHrPeUkwRe9:YvXKXyPgZc0vdsGUUUkee9
MD5:	8A5E8FFF4749032DEE7AA1DF190A4AEC
SHA1:	0CCD808EBD44FB919F50CB105F2614D8287B6FAF
SHA-256:	86A9D4AB595F6FCEE47480D17070CFDC3DAF14B2A3B82F7435BEFB9B3AD12BBE
SHA-512:	26D20E191A0B3F190C503B7B7553A6A1992415DBDC1315CBFAC46436A61736FCF2CAB19780410523468F98DC8D685737D4FCE294D7B8B7B0B76F4D11DB129B42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283813760045535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyRUL0IiHVoZcg1vRcR0YctDDoAvJTqgFCrPeUkwRe9:YvXKXyPgZc0vdsGTq16Ukee9
MD5:	B799F89EBDA7B271883149DCFE78D26E
SHA1:	CEA854C840B2C4B3A11BA3569BBE4B554DC2068A
SHA-256:	84E56DA4DE8DCDECA8B2EE1D7B1362C5ADDEDDE0DF8C33E0A70C4C96E5D7BCC0
SHA-512:	4E344C8D7402576D286CDABEAECDFDF2BD10183DF7C155C81D1E29B058C591AF50554E9AFE4E0EA1E2224CDFFB1B39D4A20FC0C25ECCC18DB2644CBDCF5F6B47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1e3b621f-8987-4404-980e-3335a0c60d4e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1735321997060,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135448765739609
Encrypted:	false
SSDEEP:	24:YkMpTaanayYYjPZFcoRJEKHAWbX4GjNj0Se1hCfChhGT2gF752LS1Lw69BLg5BBA:YkephGo8SAuX3hWu6MT5dv06j819BQ
MD5:	FDDDC59207B42336667A21A8862363F7
SHA1:	94E334212F4E81E718EFF6E1FE232FA9F2226520
SHA-256:	C9DA5FACDB1B8D3DF40434CAF7E45D851DFF076B986C6FED11133036148342F7
SHA-512:	77C781CBCB8EAF316735C478CB9112DC6AEF6D847429256737365DFAF8CC1F6C3DF32C8356D28538E50A9AFCB54605B9FAD73E9B922ADBDD5B14CAD12A003307
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ff941d5740195c3f2474dfc189f32f12","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1735143287000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ac605ffd90e41b7af39ee1ae726e35fa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1735143287000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a9b4e296607c21e85b6c4fb6443becfd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1735143287000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2ae668e4061df8437abd58dadd22175d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1735143287000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e41e2f2cc7f0a52712d745b622c8354b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1735143287000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5e2521f787c8df2d5821d0d854bae088","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886841459529511
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUaupSvR9H9vxFGiDIAEkGVvpuuN:lNVmswUUUUUUUU5p+FGSIt5N
MD5:	6E0331CB97212047C84A05FD9F608013
SHA1:	698678C3F0DB42419C6C7080CD2445644FCC0702
SHA-256:	631234DCF659AE25B10217D73C1FAA7B3CB931C1C4385999A6C81894671B1C42
SHA-512:	6591665999EE7225BB0B2D17126C4685C66E7218FDB1AAAC81C93DF1E3C96C2336EE5B94738323CD4B35FD6F4DC489BC960FA71955AF421C1F4871666B52C1FA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078195450751858
Encrypted:	false
SSDEEP:	48:7MEKUUUUUUUUUUauBvR9H9vxFGiDIAEkGVvsqFl2GL7msqy:7IUUUUUUUUUU5lFGSItiKVmsqy
MD5:	F61FE135E4D8B291981FBA563121414C
SHA1:	01A9795ECFC9075B1EFFFCA1CB6FFAE1E1A49266
SHA-256:	1418E549C7E931755A58ED07B6AD2A805AD5736151159177DA4F97416221EA13
SHA-512:	A40683595589EB79B93368074C0807E15BA3D665477F45847F9B8017E8C056D8022830F9E5E1806F61FB8721FCA497BDEE0C4B02C6208791770D63BA8C8EB98D
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvD2tzg0rb/X1vr06JigL6VNzlNgwYyu:6a6TZ44ADEvDOzg0rb/lg5Nf7K
MD5:	416E938D2BCC7EAE8C32DDBAFA6C72B1
SHA1:	F600F363692592277B66ED6FF93A97A5B654C25D
SHA-256:	74A7B180DB635A01D20973BFD72EBDE64F1BE443443FABB3C45F095D458C9231
SHA-512:	C963673D33CD055D80D168999135084E7578E675305ECCC6BA59D802888EADEB586515C95AC48E7CB49A2615A359AD0A2CFB01849D3F9FB53360CC9E83BE32FB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-25 11-14-38-659.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.35777540426619
Encrypted:	false
SSDEEP:	384:qeEoAo9oApApJpUzpNphMpipOpqp+qjqNr4WrW9l7ld0w0I0n0I0EhiBidibvvvz:qzjMLqbCzfLMIM0kMCcK+B7r3YJ7mG4b
MD5:	345B376C82D40E0FC4DD492C3229CF33
SHA1:	F6CE82A8190517C012F22D39728F2EAF7EF10339
SHA-256:	829EEB3EC0D4E83B4C15E2D0DA6D4A3083F33E80918771A57906978FF69D1A0F
SHA-512:	3B91AA58416BCE043010C6886E45941C6DE1536701B21D569F7FD0ADB6A283AD6F578731EA4788C48470D54FCC52BEBCE750B4EA91DCF13CE622367E729E4397
Malicious:	false
Preview:	SessionID=350708f5-554b-4732-8102-d88d859592d3.1735143278680 Timestamp=2024-12-25T11:14:38:680-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=350708f5-554b-4732-8102-d88d859592d3.1735143278680 Timestamp=2024-12-25T11:14:38:682-0500 ThreadID=7976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=350708f5-554b-4732-8102-d88d859592d3.1735143278680 Timestamp=2024-12-25T11:14:38:682-0500 ThreadID=7976 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=350708f5-554b-4732-8102-d88d859592d3.1735143278680 Timestamp=2024-12-25T11:14:38:682-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=350708f5-554b-4732-8102-d88d859592d3.1735143278680 Timestamp=2024-12-25T11:14:38:683-0500 ThreadID=7976 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3912898237705855
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r5:l
MD5:	B8FE2966D792B63C8D3E7D793EE66BE8
SHA1:	8FD58E29F5B9171C260A3B04721DB7F1A2EC1242
SHA-256:	87B68725C3C7082971B7D1BFBB0140E8FD73E108C2EC1866527EC861532793E5
SHA-512:	C49A72A24EC66A77E517C538E961780DBEFFFDFCE576C3D7D4318C26A66C2CFF7B8500254ACD7CA10137CBC3F9442EFBE66C4E01A15E053C58AE7E4DABC316C5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3974edcf-deda-4e50-a340-f02b86703fa9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/AYIGNPg5mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:YZG+5bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	67EE77CBB3D80A714C996E4D2140CA40
SHA1:	EDD898AD748F1768695534E1F4443577C0080D18
SHA-256:	7D85503F57F2F972A24DA634140A5B4FE63A9D7DE821702148EB45AA302F4293
SHA-512:	D9163FF6C99480051FBC03331F0CA209DB91AD6CCF968A4117DE5DF2052D83AA9B2D234AAD8CE5A1DCEA1F6E1FCE7DAB11AE2EA2E0CD2486173754F67762A13E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c6474ada-6355-4df0-b798-8181481884a3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yawYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:3wZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	CFE92F09B3CF5F1D659B8E273EA6BE32
SHA1:	5434B8D5E70B5C581C383413B92C835DD7E9D8CC
SHA-256:	6E57E3E8E384579FE6B1F8BE103EBD1DBC57FC80171A1E34CB87C29603FBD601
SHA-512:	838DF787F3032E647AFF8F311C829C5E2F39C47EC432BD0A51F6B262C0C5CB6F63802DCB2DD4F92EFC4C816372E65AEDF4E19D4346793D1D94A485A8FF94A60C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\db6d38d2-be7b-43af-a6ac-5df922ace011.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f3df78fc-4b5b-45e3-a42b-6e49366f3ceb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UI:O3Pjegf121YS8lkipdjMMNB1DofjgJJE
MD5:	E0C414FA00EC54ABF493C4E1A12B78BA
SHA1:	C34D20BB5FE6C68AE5F80225A8E15FECF3024EE2
SHA-256:	35E5559C0AB1970EF75CC482FB9B2F72CAE090C102D918EDC744DDC385DC5104
SHA-512:	BB42E63A264A83A0C8825DE784DFF56D49D6D76433CBC8E3D228AB267B12CE52FB4F0BD524955AE84FBE1D7185CB48EA0B6A0FCC3E9E93F4F227709B1E087EBF
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\doc.pdf

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	85137
Entropy (8bit):	7.7513343990244366
Encrypted:	false
SSDEEP:	1536:eyetDLuxUTpyWbzUGW7EmvP95imdqYKq6i97idLfnk:eyetMk1tCPfimdsq6ididL8
MD5:	17A9D7D59ED8076A38B9E48533A01A10
SHA1:	1EC63D0BECCCBCE15277A3C227E787131C1E8F74
SHA-256:	631C4D8C4D0DE76F18712484358E532BE32F2FA2F92D7FAB026406C346ACBCDA
SHA-512:	E3C8AD153864482AC0BDE7445DAFFF1DAC9DCBC48D83C99169388C2EEE832EDDB02B4A2553F60D81E93674F76880544F4C10F05098830E7931518D14DF1DCFED
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(ru) /StructTreeRoot 37 0 R/MarkInfo<</Marked true>>/Metadata 351 0 R/ViewerPreferences 352 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R/F5 24 0 R>>/ExtGState<</GS10 10 0 R/GS11 11 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 1237>>..stream..x..Ko.6.....w.1)`...C.....Z4...r.z.!..F....J...).+.`.k...>....o4....._........V..<>.7_..>.=.T.6....h3...A.e+..U`...o_..O?.......{P....m..>m..`5..g......{w.F=......!L.w.....6.iLK.._..O.]...a.S..F...I....~.x.nL......}.;J\|..>....d..L.....=...QB[.4p^[..t.dB...!.=.......v...]h.0F.......C....5&B....Yoz.n....c[W<........'. .1.9?...m.).hG.)!Zm...:..K(I.d...\..s..%.

C:\Users\user\AppData\Local\Temp\doc2.pdf

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	85137
Entropy (8bit):	7.7513343990244366
Encrypted:	false
SSDEEP:	1536:eyetDLuxUTpyWbzUGW7EmvP95imdqYKq6i97idLfnk:eyetMk1tCPfimdsq6ididL8
MD5:	17A9D7D59ED8076A38B9E48533A01A10
SHA1:	1EC63D0BECCCBCE15277A3C227E787131C1E8F74
SHA-256:	631C4D8C4D0DE76F18712484358E532BE32F2FA2F92D7FAB026406C346ACBCDA
SHA-512:	E3C8AD153864482AC0BDE7445DAFFF1DAC9DCBC48D83C99169388C2EEE832EDDB02B4A2553F60D81E93674F76880544F4C10F05098830E7931518D14DF1DCFED
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(ru) /StructTreeRoot 37 0 R/MarkInfo<</Marked true>>/Metadata 351 0 R/ViewerPreferences 352 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R/F5 24 0 R>>/ExtGState<</GS10 10 0 R/GS11 11 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 1237>>..stream..x..Ko.6.....w.1)`...C.....Z4...r.z.!..F....J...).+.`.k...>....o4....._........V..<>.7_..>.=.T.6....h3...A.e+..U`...o_..O?.......{P....m..>m..`5..g......{w.F=......!L.w.....6.iLK.._..O.]...a.S..F...I....~.x.nL......}.;J\|..>....d..L.....=...QB[.4p^[..t.dB...!.=.......v...]h.0F.......C....5&B....Yoz.n....c[W<........'. .1.9?...m.).hG.)!Zm...:..K(I.d...\..s..%.

C:\Users\user\AppData\Local\Temp\ms.msi

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\start.bat

Download File

Process:	C:\Users\user\Desktop\0442.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.924404357134264
Encrypted:	false
SSDEEP:	3:mKDb2nppLJTXZkRErG+fyM1K/RFofD6ANntch9wQn:hb4ZGaH1MUmy2Nn
MD5:	AA3AAB4A5BCA1D06B08C6F5D6362A5D0
SHA1:	486D423A2B689CC119CE95DFCDC018C7B552FA24
SHA-256:	A0A569883E851B4B965088F9ED9F9FBA80803B47AC6E6DD4B07DF60435184CD4
SHA-512:	2B5F84DFB399F313D11A8BFA2F3F3338CF69711D5C7B6D86E7F876C8B64DB3A664D1E3E4A4A4B0066A6949DE4E64CBA416A40BE56461556F9216EE82DE23D913
Malicious:	false
Preview:	@echo of..ping 8.8.8.8..cls..del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\." /q..cls..exit

C:\Windows\Installer\5511f4.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\5511f7.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11553792
Entropy (8bit):	7.938196666665725
Encrypted:	false
SSDEEP:	196608:cJg0ov2gTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:CRJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	B02F581793BE146506FACC3C6AEEBC32
SHA1:	DB1CB3BD3744C77E6E3253CF4480E177A358669A
SHA-256:	1666B1C2AE1AF47B252ABBC69C80281F81A7EA979F1D784FADC19ED6FEEC59F0
SHA-512:	8113F897F5936F6393746635D2BEDCEB410DBD1F825DF28C65D96EC3390509755E63E01C5311EC0A78B2FF48579D634C5D77CED80FBA01B68D2E9A08223B8E0A
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI186C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	292991
Entropy (8bit):	4.840189477976563
Encrypted:	false
SSDEEP:	3072:P4oy2KjcC2jcmFDX/vjcJGUjcmFDX/rjcmFDX/dZ+cNbynfM:P4oy25DXmNDXLDXX+cNbynfM
MD5:	A970C44274E3DAA2BE46A593BDF1DFC8
SHA1:	EA4842EABB3679DD1A2E069960D7BAD09EACB834
SHA-256:	04A530D63D77533FF5AF3E1C826CA72F5C19787B04B8A9FA4E19398777790A20
SHA-512:	764FE781F67D52D5A90F6F1EC5CD2DF49D3A293C3C6EDBA45086A52CF345C41A977D2C4FDED5CB93645926B95E05ADB6DBDB6D240C8C773851CF2C539BCF5C8A
Malicious:	false
Preview:	...@IXOS.@.....@.Y.Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..ms.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{3244CDE6-6414-4399-B0D5-424562747210}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}5.C:\Program Files (x86)\LiteManager Pro - Server\Lang\.@.......@.....@.....@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}C.C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{596F4636-5D51-49F

C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1603065050834016
Encrypted:	false
SSDEEP:	12:JSbX72FjiNZAGiLIlHVRpBh/7777777777777777777777777vDHFfbe2vtJW4pC:JoQI5V9dviGF
MD5:	FFF76757F67C60E629A1712BEDF965D4
SHA1:	9726F2492F70AEB7F9322A0AEC0F111AA324727E
SHA-256:	E5E965818875BA2746081F4E7AF715EDC8CE34E0708E649D4DACE603599126BC
SHA-512:	16D507EFAC1E89E3A80074CBFBB18A94E1E907A7E72E6CF5606E20DDBA22535AFB8BDB3B35B43E5F9316D1B95BB844FE723206EBD2F74BCFEEE46C9BFE86B6FD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.784872839269826
Encrypted:	false
SSDEEP:	48:Z8Ph+uRc06WXJSjT5p9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29l2:Uh+1JjT2Gm0WlfPu2qC0WlfIF/
MD5:	20657139A279B76F9D304274D748D5B7
SHA1:	99896ED9496B22E0B9FC2314A683D4F1C27ADC01
SHA-256:	DAC31C38433670EE8789F6C3D9DE0D106EAFFB38B9DF76A1AA054B01123B57FF
SHA-512:	CECBD223799E2918354D4AE80D64E71C4F2C51D28C97C84A84FA7F214110A7FCEBFD34FEEBA4D4A5D9F4346BEDA9CEAD0A663ACB7F4A4C4330AC0E0A15EE4029
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.351781833522881
Encrypted:	false
SSDEEP:	384:AvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZUNeLNek+vDFNe+TNy:+MAyYdTmPJbgqcnDcCNy
MD5:	CA680899D9330BEB85E6351E6DC0D27B
SHA1:	41E89E582F58FB2A4ED06FA3BF796A1DAAC5CB6C
SHA-256:	EAB5DC45781E92CD5CF953016757B1E6F2ED7A0B5A97CC0945B19A8FBC1A85F2
SHA-512:	3817BD6EC345F96631E6CBF6C8DD384ACB17D912B1EC69D959F3AA15C05226D5FE3B5E9807D42D0E63589AABCEADFBE8BD5F293D8069DF689D12498E05842286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(........0...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.31126714354722
Encrypted:	false
SSDEEP:	384:EvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZMwQE3vGYksuektm6yysZc8:SMAyYdTmPJbgqcnDcmwQE/RkHRRNS
MD5:	6A4AFFF2CD33613166B37A0DAB99BD41
SHA1:	FBC0F1696213B459D099A5809D79CFC01253880F
SHA-256:	53C1AE4962663E82D3AAC7C4A6CBE3D53E05D6948ADAE6391A2748396ACF98FE
SHA-512:	7B61D32E4AD38BC21E86559BFFA49A334CCB6184E595CB43F2D60A2A77C86B31D07B1A9D1F8FBE69E9AAD7E096952D765404BEBC494E73BD992642EB6B82E3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...p...............P....@.........................................................................4T..(........+...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....+.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.37517788115078
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaux:zTtbmkExhMJCIpEr8
MD5:	386286F8A6683D88D624555F590C1C49
SHA1:	18C9BB43E7A047ABB535DCA30B457D2B979113F9
SHA-256:	B059EE2F07B114B9377D634597C688AE1B8DB1F48B0B2E737959AA92CE3589C6
SHA-512:	E39E19F6D0F5BC0F8CB784741FECC4B42A08EA6B3E154FC996741DAF287D7F04918B695FB3CB8043B16911631E61BCFEA85E2A1C655978DE0B0CD8E67E2C4884
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\~DF059E19C7A22C7C5E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4140121956033092
Encrypted:	false
SSDEEP:	48:RlWuDI+CFXJFT55qq9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29lOp:PWldT3OGm0WlfPu2qC0WlfIF/
MD5:	110DAE8DD37EF98DBC90F95252829539
SHA1:	85BC2375B3EB98261513FF342DAF54C5B7E31557
SHA-256:	C476E3C8CA63BF98B4D094622BBD2BB751E922133D2A5332013BBD62BE8675C7
SHA-512:	1360AD3654E499CE0C6513EE6CD5D4FF7ECFB5843F6A68C194578B6A47BAD520D0C4C38872D1AAD5EB5024EF8D381552B128904BEFA291111BBB468F5DB859C8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1DD5A66FCA1BCC73.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4140121956033092
Encrypted:	false
SSDEEP:	48:RlWuDI+CFXJFT55qq9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29lOp:PWldT3OGm0WlfPu2qC0WlfIF/
MD5:	110DAE8DD37EF98DBC90F95252829539
SHA1:	85BC2375B3EB98261513FF342DAF54C5B7E31557
SHA-256:	C476E3C8CA63BF98B4D094622BBD2BB751E922133D2A5332013BBD62BE8675C7
SHA-512:	1360AD3654E499CE0C6513EE6CD5D4FF7ECFB5843F6A68C194578B6A47BAD520D0C4C38872D1AAD5EB5024EF8D381552B128904BEFA291111BBB468F5DB859C8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2BEBCD2C7E878169.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.784872839269826
Encrypted:	false
SSDEEP:	48:Z8Ph+uRc06WXJSjT5p9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29l2:Uh+1JjT2Gm0WlfPu2qC0WlfIF/
MD5:	20657139A279B76F9D304274D748D5B7
SHA1:	99896ED9496B22E0B9FC2314A683D4F1C27ADC01
SHA-256:	DAC31C38433670EE8789F6C3D9DE0D106EAFFB38B9DF76A1AA054B01123B57FF
SHA-512:	CECBD223799E2918354D4AE80D64E71C4F2C51D28C97C84A84FA7F214110A7FCEBFD34FEEBA4D4A5D9F4346BEDA9CEAD0A663ACB7F4A4C4330AC0E0A15EE4029
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2DB8AEE9EBEC810F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4140121956033092
Encrypted:	false
SSDEEP:	48:RlWuDI+CFXJFT55qq9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29lOp:PWldT3OGm0WlfPu2qC0WlfIF/
MD5:	110DAE8DD37EF98DBC90F95252829539
SHA1:	85BC2375B3EB98261513FF342DAF54C5B7E31557
SHA-256:	C476E3C8CA63BF98B4D094622BBD2BB751E922133D2A5332013BBD62BE8675C7
SHA-512:	1360AD3654E499CE0C6513EE6CD5D4FF7ECFB5843F6A68C194578B6A47BAD520D0C4C38872D1AAD5EB5024EF8D381552B128904BEFA291111BBB468F5DB859C8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3E5BF2471C3714A1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06712149920142403
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO0AbuJ2vWEJWM1AVky6lO:2F0i8n0itFzDHFfbe2vtJWuO
MD5:	0E8B611CF5EFD5D7F4C345B5C4E1443E
SHA1:	88A30155409C7EF376FB080774D617FCD51EEB6B
SHA-256:	1DDAF54603271883C75BDB3FB0D5D7FA324500D3ECC46649D583F73FE82FBB4D
SHA-512:	6AF62D7F4423FD2635320D0E94D40F31502581BF4CE800729F8040E6A962D4E178DDA94B8C10499FAF03C37BF914598A14B1539FD2A18B83A90958235CA131EE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4902D850E215DBB6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.22078609821458883
Encrypted:	false
SSDEEP:	48:PHwmFSB29lOd5YpRXd5YNd5YGd5YMd5Yu9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad9:PH5FqC0WlfVm0WlfPuh
MD5:	5E02AB17D44237F4E1F158A9EB7CB37E
SHA1:	F6EB35C0438582EFF26C7797FCE78D69F8E52BE2
SHA-256:	C7A977777109DDABEC404C8D764F169FA4C644ED9CC7316B90EA92DB2E18FD03
SHA-512:	771F44813771A5F1FF747B6BF60805F86BA82CC37E3DF571A80891B0D7AF60972EDD58BDDFA12AFC9C368030181033E10DBAC7F8B1DEFDD601C911F90EB2FB4A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4CD98377568A0A18.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.784872839269826
Encrypted:	false
SSDEEP:	48:Z8Ph+uRc06WXJSjT5p9cgY9mSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YYo9ISB29l2:Uh+1JjT2Gm0WlfPu2qC0WlfIF/
MD5:	20657139A279B76F9D304274D748D5B7
SHA1:	99896ED9496B22E0B9FC2314A683D4F1C27ADC01
SHA-256:	DAC31C38433670EE8789F6C3D9DE0D106EAFFB38B9DF76A1AA054B01123B57FF
SHA-512:	CECBD223799E2918354D4AE80D64E71C4F2C51D28C97C84A84FA7F214110A7FCEBFD34FEEBA4D4A5D9F4346BEDA9CEAD0A663ACB7F4A4C4330AC0E0A15EE4029
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF68E3D5A61E333701.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8F7A50411E8F0ED9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9A3C21EA7B6E1F53.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAE4B5E7ECBA685CE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF560FDBF33EC6D5B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.988555676370944
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0442.pdf.exe
File size:	11'409'543 bytes
MD5:	4f6b2b9ee57c50d6c505d0cdada4803e
SHA1:	ad7dee6f1f71c4fe6299170a160592f139390e12
SHA256:	62410e8399acf7834c74012783bde3fe9ff244e048141c4a96a65bec06895f37
SHA512:	43607bd5bd78dea051340a684ad3311172adc590e5ffcd8a7c576e3f6ddba7e13750bab2a957b4d9fdec0d68b67d5391e779ee625006d00b82a65ecfc62525ce
SSDEEP:	196608:rqwdhlYLDYm+q6yU4zpDKpuLkQ9aP8F5hidaKsv7kDXFd+bIYW2LJjIeTF:Nw3Yi6yU4zpDeuREkF5PlgP+0ijIeh
TLSH:	75B6334AF79008F8E0E6F67485778425E6723D4E1338A59F57A83A2B7E773118C36722
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0fd88dc89ea7861b

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F972CDE74F8h
dec eax
add esp, 28h
jmp 00007F972CDE6E8Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F972CDE6313h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F972CDE7023h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F972CDE9037h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F972CDD58A3h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F972CDE80F2h
int3
jmp 00007F972CDEE2D4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x154f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x154f4	0x15600	830fe0401acd1728e669a91fa1858e36	False	0.2520559210526316	data	4.6583703321340835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x70554	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x7109c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x72648	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m			0.14468236129184905
RT_DIALOG	0x82e70	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x830f8	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x83234	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x83320	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x83450	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x83788	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x839dc	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x83bc0	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x83d8c	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x83f44	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x8408c	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x844f8	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x84660	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x847b4	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x848c0	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x8497c	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x84b3c	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x84d8c	0x14	data			1.15
RT_MANIFEST	0x84da0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:14:51.819722891 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.833385944 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.850236893 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.943408012 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:51.943872929 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.958348036 CET	80	49747	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:51.958441019 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.970360041 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.970392942 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:51.976269960 CET	8080	49748	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:51.976849079 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:52.001658916 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:52.001738071 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:52.007046938 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:52.007181883 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:52.090029001 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:52.090035915 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:52.121200085 CET	80	49747	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:52.121206999 CET	80	49747	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:52.126476049 CET	8080	49748	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:52.126594067 CET	8080	49748	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:53.490300894 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:53.490437984 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:53.490474939 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:53.490494013 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:53.490511894 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:53.610096931 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:53.610110998 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:53.610141039 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:53.610153913 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.147437096 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.190809965 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:54.543502092 CET	80	49747	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.543601036 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:54.543791056 CET	49747	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:54.561148882 CET	8080	49748	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.561223030 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:54.561364889 CET	49748	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:54.664460897 CET	80	49747	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.707195997 CET	8080	49748	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:54.991230011 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.017318964 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.112078905 CET	80	49752	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.119240046 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.136889935 CET	8080	49753	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.143356085 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.163198948 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.209120035 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.209196091 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.209301949 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.209301949 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.221676111 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:55.330818892 CET	80	49752	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.330826998 CET	80	49752	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.330919981 CET	8080	49753	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:55.330925941 CET	8080	49753	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:56.178407907 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:56.221529007 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.194031954 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:57.237454891 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.732666969 CET	80	49752	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:57.734252930 CET	8080	49753	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:57.734329939 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.734388113 CET	49752	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.734396935 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.734627008 CET	49753	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.853966951 CET	80	49752	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:57.854026079 CET	8080	49753	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:57.924963951 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:57.926749945 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.047094107 CET	80	49755	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.047161102 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.048719883 CET	8080	49756	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.048801899 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.159271955 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.159271955 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.174813032 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.174813032 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.209528923 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.252772093 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:14:58.282641888 CET	80	49755	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.282655001 CET	80	49755	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.298247099 CET	8080	49756	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:58.298257113 CET	8080	49756	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:59.226660967 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:14:59.268393993 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.240886927 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:00.284040928 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.640944958 CET	80	49755	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:00.643274069 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.643403053 CET	49755	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.693263054 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.763320923 CET	80	49755	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:00.818615913 CET	80	49758	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:00.818722010 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.831003904 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.831135988 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:00.957277060 CET	80	49758	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:00.957288980 CET	80	49758	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:01.256477118 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:01.299654007 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:02.257060051 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:02.299653053 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:03.272361040 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:03.315367937 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:03.421484947 CET	80	49758	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:03.421665907 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:03.421751976 CET	49758	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:03.541246891 CET	80	49758	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:04.240906000 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:04.288106918 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:04.330914021 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:04.362214088 CET	80	49759	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:04.362286091 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:04.378006935 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:04.378225088 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:04.501583099 CET	80	49759	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:04.501722097 CET	80	49759	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:05.303344011 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:05.346527100 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:05.903867006 CET	8080	49756	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:05.903963089 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:05.904036045 CET	49756	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:05.943161964 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.023631096 CET	8080	49756	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.062714100 CET	8080	49760	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.062774897 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.081070900 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.081070900 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.200649023 CET	8080	49760	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.200660944 CET	8080	49760	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.320875883 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.377801895 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.951539040 CET	80	49759	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:06.951719999 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:06.951961994 CET	49759	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:07.037416935 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:07.074275017 CET	80	49759	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:07.157169104 CET	80	49761	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:07.157550097 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:07.175193071 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:07.175271034 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:07.296171904 CET	80	49761	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:07.296178102 CET	80	49761	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:07.320295095 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:07.362210035 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.350413084 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:08.393420935 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.652812004 CET	8080	49760	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:08.652863026 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.653107882 CET	49760	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.676547050 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.772541046 CET	8080	49760	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:08.796854973 CET	8080	49762	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:08.796916962 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.815390110 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.815399885 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:08.935033083 CET	8080	49762	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:08.935049057 CET	8080	49762	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:09.365780115 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:09.409058094 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.749542952 CET	80	49761	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:09.749682903 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.749684095 CET	49761	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.769474030 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.869891882 CET	80	49761	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:09.889003992 CET	80	49763	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:09.889238119 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.909116030 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:09.909116030 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:10.029022932 CET	80	49763	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:10.029038906 CET	80	49763	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:10.383865118 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:10.440288067 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.386495113 CET	8080	49762	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:11.386650085 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.386749029 CET	49762	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.397641897 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:11.416311979 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.440284967 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.506546974 CET	8080	49762	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:11.536386013 CET	8080	49764	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:11.536467075 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.549731016 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.549777985 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:11.669336081 CET	8080	49764	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:11.669353008 CET	8080	49764	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.513658047 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.513672113 CET	80	49763	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.513792992 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.513938904 CET	49763	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.565357924 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.612973928 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.639537096 CET	80	49763	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.732662916 CET	80	49765	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.732856989 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.753336906 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.753405094 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:12.873111963 CET	80	49765	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:12.873122931 CET	80	49765	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:13.431006908 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:13.487184048 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.121741056 CET	8080	49764	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.121817112 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.121916056 CET	49764	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.145646095 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.242021084 CET	8080	49764	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.265304089 CET	8080	49766	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.265494108 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.284126043 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.284126043 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:14.403817892 CET	8080	49766	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.403827906 CET	8080	49766	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.444094896 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:14.487251997 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.326598883 CET	80	49765	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:15.326729059 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.326770067 CET	49765	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.347647905 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.446271896 CET	80	49765	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:15.460448027 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:15.467197895 CET	80	49767	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:15.467271090 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.487299919 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.487299919 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.502796888 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:15.607043028 CET	80	49767	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:15.607053995 CET	80	49767	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:16.474906921 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:16.519248009 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:16.860780954 CET	8080	49766	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:16.860902071 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:16.860987902 CET	49766	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:16.881819963 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:16.980544090 CET	8080	49766	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:17.001425028 CET	8080	49768	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:17.001822948 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:17.018551111 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:17.018551111 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:17.138221979 CET	8080	49768	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:17.138232946 CET	8080	49768	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:17.475301981 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:17.518433094 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.059637070 CET	80	49767	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.059715033 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.059766054 CET	49767	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.082247019 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.179994106 CET	80	49767	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.202209949 CET	80	49769	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.202332973 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.221663952 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.221664906 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:18.341289043 CET	80	49769	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.341382027 CET	80	49769	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.490643978 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:18.534190893 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.491297007 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:19.534149885 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.594427109 CET	8080	49768	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:19.597301006 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.602650881 CET	49768	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.614754915 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.722313881 CET	8080	49768	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:19.734294891 CET	8080	49770	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:19.737462997 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.753313065 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.753328085 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:19.872898102 CET	8080	49770	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:19.872914076 CET	8080	49770	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:20.506444931 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:20.549711943 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.794987917 CET	80	49769	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:20.795057058 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.795120001 CET	49769	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.817523003 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.921503067 CET	80	49769	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:20.943016052 CET	80	49771	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:20.945456982 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.956034899 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:20.956034899 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:21.075617075 CET	80	49771	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:21.075881958 CET	80	49771	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:21.522176981 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:21.565321922 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.342070103 CET	8080	49770	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:22.345310926 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.345393896 CET	49770	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.349081993 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.465029955 CET	8080	49770	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:22.468703985 CET	8080	49772	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:22.470110893 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.487373114 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.487416983 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.539326906 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:22.581049919 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:22.607326031 CET	8080	49772	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:22.607351065 CET	8080	49772	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.531130075 CET	80	49771	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.531379938 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.531460047 CET	49771	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.552757025 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.553318024 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.596560001 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.650986910 CET	80	49771	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.672313929 CET	80	49773	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.672636986 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.690557957 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.690557957 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:23.810408115 CET	80	49773	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:23.810436010 CET	80	49773	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:24.569201946 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:24.613579988 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.073698044 CET	8080	49772	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.073772907 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.073865891 CET	49772	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.087522984 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.193521023 CET	8080	49772	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.207134008 CET	8080	49774	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.207330942 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.221668959 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.221802950 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:25.341195107 CET	8080	49774	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.341320038 CET	8080	49774	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.584611893 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:25.627840042 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.280754089 CET	80	49773	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.280836105 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.281002045 CET	49773	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.288187981 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.403583050 CET	80	49773	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.412738085 CET	80	49775	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.412796974 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.424880028 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.424896002 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:26.544496059 CET	80	49775	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.544513941 CET	80	49775	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.600291014 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:26.643445015 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.615597963 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:27.674741030 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.810894012 CET	8080	49774	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:27.813532114 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.813596964 CET	49774	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.817964077 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.934756994 CET	8080	49774	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:27.938741922 CET	8080	49776	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:27.940423012 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.956088066 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:27.957844973 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:28.078217030 CET	8080	49776	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:28.079782963 CET	8080	49776	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:28.631458998 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:28.674719095 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.024090052 CET	80	49775	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.025604010 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.025661945 CET	49775	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.145438910 CET	80	49775	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.178276062 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.300040007 CET	80	49777	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.301354885 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.394898891 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.394944906 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:29.514523029 CET	80	49777	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.514534950 CET	80	49777	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.631850958 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:29.674715996 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.536123037 CET	8080	49776	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:30.537332058 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.537431002 CET	49776	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.552522898 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.647536039 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:30.656917095 CET	8080	49776	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:30.672184944 CET	8080	49778	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:30.673371077 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.690347910 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.690685987 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.693413019 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:30.810087919 CET	8080	49778	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:30.813031912 CET	8080	49778	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:31.663008928 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:31.705954075 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:31.907335997 CET	80	49777	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:31.908730984 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:31.908811092 CET	49777	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:31.988248110 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:32.028501987 CET	80	49777	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:32.107907057 CET	80	49780	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:32.108138084 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:32.112374067 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:32.112394094 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:32.232067108 CET	80	49780	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:32.232078075 CET	80	49780	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:32.678467989 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:32.721569061 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.264904022 CET	8080	49778	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.265084028 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.265163898 CET	49778	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.285235882 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.384974003 CET	8080	49778	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.404691935 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.404753923 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.424760103 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.424774885 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:33.614306927 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.614321947 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.693794012 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:33.737435102 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:34.706069946 CET	80	49780	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:34.707817078 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:34.707895994 CET	49780	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:34.709592104 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:34.755182028 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:34.827547073 CET	80	49780	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:35.725002050 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:35.738097906 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:35.768440962 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:35.857784033 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:35.857954025 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:35.878221989 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:35.878221989 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.237473011 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.370719910 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.370784998 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.370826006 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.371063948 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.371073008 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.371081114 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.383398056 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.383440971 CET	49782	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.456988096 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.490336895 CET	8080	49782	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.609671116 CET	8080	49789	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.609760046 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.737497091 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.737541914 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.740994930 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.784091949 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:36.857009888 CET	8080	49789	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:36.857050896 CET	8080	49789	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:37.756506920 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:37.799736023 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:38.772255898 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:38.815332890 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:38.844888926 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:38.844944000 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:38.844994068 CET	49788	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:38.863023996 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:38.966530085 CET	80	49788	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:38.983234882 CET	80	49795	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:38.983303070 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.003189087 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.003200054 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.122895002 CET	80	49795	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.122968912 CET	80	49795	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.200591087 CET	8080	49789	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.201314926 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.201360941 CET	49789	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.300692081 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.320965052 CET	8080	49789	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.422193050 CET	8080	49800	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.422271013 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.440453053 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.440494061 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:39.560103893 CET	8080	49800	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.560123920 CET	8080	49800	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.772253990 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:39.816401958 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:40.787767887 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:40.830971003 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.575526953 CET	80	49795	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:41.575709105 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.575864077 CET	49795	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.597702026 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.695350885 CET	80	49795	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:41.717535973 CET	80	49806	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:41.717621088 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.737255096 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.737270117 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.803723097 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:41.846609116 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:41.862292051 CET	80	49806	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:41.862334013 CET	80	49806	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.014898062 CET	8080	49800	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.015357018 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.015357018 CET	49800	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.035233021 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.135133982 CET	8080	49800	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.155549049 CET	8080	49807	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.155633926 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.180043936 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.180242062 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:42.299706936 CET	8080	49807	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.299767971 CET	8080	49807	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.819272041 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:42.862262964 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:43.820173979 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:43.862243891 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.310231924 CET	80	49806	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.310323954 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.310364962 CET	49806	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.331859112 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.430001974 CET	80	49806	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.451641083 CET	80	49813	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.451709032 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.471656084 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.471656084 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.591391087 CET	80	49813	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.591422081 CET	80	49813	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.748317003 CET	8080	49807	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.751358032 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.751441002 CET	49807	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.769483089 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.849977970 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.873182058 CET	8080	49807	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.892855883 CET	8080	49814	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:44.892946005 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.893517017 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.909151077 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:44.909151077 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:45.029014111 CET	8080	49814	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:45.029088974 CET	8080	49814	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:45.865878105 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:45.909147978 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:46.865993977 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:46.924727917 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.050024986 CET	80	49813	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.053436041 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.053494930 CET	49813	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.066982031 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.174428940 CET	80	49813	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.187766075 CET	80	49821	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.189352989 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.348803043 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.348819971 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.468498945 CET	80	49821	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.468518972 CET	80	49821	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.481800079 CET	8080	49814	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.481872082 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.481995106 CET	49814	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:47.601557016 CET	8080	49814	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.881335020 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:47.924906969 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:48.425911903 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:48.545531988 CET	8080	49826	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:48.545608044 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:48.565546989 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:48.565563917 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:48.685319901 CET	8080	49826	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:48.685343027 CET	8080	49826	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:48.897042990 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:48.940351009 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:49.777209044 CET	80	49821	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:49.779452085 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:49.779452085 CET	49821	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:49.838510036 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:49.899075031 CET	80	49821	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:49.915301085 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:49.956073999 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:49.958121061 CET	80	49828	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:49.958215952 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:50.001144886 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:50.001508951 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:50.120832920 CET	80	49828	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:50.121124983 CET	80	49828	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:50.928343058 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:50.971620083 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.138534069 CET	8080	49826	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:51.139437914 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.139437914 CET	49826	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.222620010 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.259309053 CET	8080	49826	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:51.342235088 CET	8080	49833	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:51.342417002 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.362406015 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.362406015 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:51.482141018 CET	8080	49833	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:51.482157946 CET	8080	49833	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:51.944006920 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:52.002957106 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.543883085 CET	80	49828	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:52.547432899 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.574152946 CET	49828	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.696707010 CET	80	49828	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:52.787355900 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.907748938 CET	80	49839	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:52.907828093 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.909394026 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.909413099 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:52.959678888 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:53.002851963 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:53.029196978 CET	80	49839	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:53.029216051 CET	80	49839	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:53.937709093 CET	8080	49833	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:53.937789917 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:53.937855005 CET	49833	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:53.956774950 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:53.974754095 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:54.018487930 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:54.063615084 CET	8080	49833	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:54.082462072 CET	8080	49841	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:54.082530975 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:54.096694946 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:54.096708059 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:54.219851017 CET	8080	49841	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:54.219897032 CET	8080	49841	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:54.991044044 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:55.034106970 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.503947973 CET	80	49839	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:55.505359888 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.511986017 CET	49839	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.598112106 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.633407116 CET	80	49839	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:55.718647957 CET	80	49846	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:55.718708992 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.737339020 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.737358093 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:55.857044935 CET	80	49846	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:55.857126951 CET	80	49846	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.006448984 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.049798965 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.685214043 CET	8080	49841	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.686362982 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.686400890 CET	49841	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.691674948 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.805939913 CET	8080	49841	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.811228991 CET	8080	49852	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.811301947 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.831123114 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.831186056 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:56.950788021 CET	8080	49852	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:56.950798035 CET	8080	49852	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:57.021910906 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:57.065371990 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.037600994 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:58.080996037 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.311505079 CET	80	49846	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:58.311564922 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.311615944 CET	49846	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.331841946 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.431098938 CET	80	49846	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:58.451636076 CET	80	49854	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:58.451699972 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.471745014 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.471756935 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:58.596502066 CET	80	49854	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:58.596604109 CET	80	49854	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:59.054028034 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:59.096633911 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.720254898 CET	8080	49852	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:59.720314980 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.720351934 CET	49852	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.754175901 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.844786882 CET	8080	49852	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:59.875689983 CET	8080	49859	101.99.91.150	192.168.2.4
Dec 25, 2024 17:15:59.875746965 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.893625975 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:15:59.893640995 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:00.013986111 CET	8080	49859	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:00.014002085 CET	8080	49859	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:00.068914890 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:00.112255096 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.044452906 CET	80	49854	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:01.044523954 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.044583082 CET	49854	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.066505909 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.084800959 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:01.127863884 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.164256096 CET	80	49854	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:01.187975883 CET	80	49865	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:01.188143969 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.206890106 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.206890106 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:01.327203035 CET	80	49865	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:01.327218056 CET	80	49865	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.100672960 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.143569946 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.467005968 CET	8080	49859	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.467081070 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.467122078 CET	49859	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.488490105 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.588185072 CET	8080	49859	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.631103039 CET	8080	49866	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.631205082 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.768749952 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.768750906 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:02.895025015 CET	8080	49866	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:02.895041943 CET	8080	49866	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:03.116063118 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:03.174735069 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.779685974 CET	80	49865	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:03.779793978 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.779793978 CET	49865	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.800874949 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.899555922 CET	80	49865	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:03.920520067 CET	80	49872	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:03.920656919 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.940541983 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:03.940541983 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:04.060165882 CET	80	49872	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:04.060174942 CET	80	49872	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:04.131865025 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:04.174750090 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.146785975 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:05.190377951 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.216181993 CET	8080	49866	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:05.216300964 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.216352940 CET	49866	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.222508907 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.335890055 CET	8080	49866	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:05.342056990 CET	8080	49874	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:05.342303991 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.362353086 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.362365961 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:05.481878996 CET	8080	49874	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:05.481895924 CET	8080	49874	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.162611961 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.206016064 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.514812946 CET	80	49872	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.514890909 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.515085936 CET	49872	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.535119057 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.634547949 CET	80	49872	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.670913935 CET	80	49879	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.671200991 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.675105095 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.675117970 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:06.798721075 CET	80	49879	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:06.798738956 CET	80	49879	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:07.178308964 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:07.221642971 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:07.935376883 CET	8080	49874	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:07.935461998 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:07.935518026 CET	49874	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:07.957210064 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:08.057575941 CET	8080	49874	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:08.079710960 CET	8080	49885	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:08.080074072 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:08.096771955 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:08.096785069 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:08.194220066 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:08.216675043 CET	8080	49885	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:08.216706991 CET	8080	49885	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:08.237299919 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.209382057 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:09.252887011 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.282390118 CET	80	49879	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:09.282468081 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.282504082 CET	49879	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.378817081 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.402075052 CET	80	49879	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:09.498596907 CET	80	49887	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:09.498673916 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.518974066 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.518999100 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:09.642301083 CET	80	49887	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:09.642339945 CET	80	49887	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.225579977 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.268518925 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.685534000 CET	8080	49885	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.687360048 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.687953949 CET	49885	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.696439981 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.808173895 CET	8080	49885	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.817630053 CET	8080	49892	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.819365978 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.831130028 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.831166029 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:10.953564882 CET	8080	49892	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:10.953597069 CET	8080	49892	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:11.240989923 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:11.284143925 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.106597900 CET	80	49887	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:12.106676102 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.106712103 CET	49887	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.113193035 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.227454901 CET	80	49887	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:12.233768940 CET	80	49898	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:12.233845949 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.252991915 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.253034115 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.256731033 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:12.299766064 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:12.379410028 CET	80	49898	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:12.379443884 CET	80	49898	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.272303104 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.315402985 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.433948040 CET	8080	49892	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.434046984 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.435348988 CET	49892	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.558563948 CET	8080	49892	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.586280107 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.706737041 CET	8080	49899	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.706840038 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.721782923 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.721956968 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:13.841607094 CET	8080	49899	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:13.841775894 CET	8080	49899	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:14.287396908 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:14.331012011 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.829680920 CET	80	49898	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:14.829746008 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.829809904 CET	49898	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.847989082 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.949440002 CET	80	49898	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:14.967962980 CET	80	49905	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:14.968055010 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.987363100 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:14.987413883 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:15.114039898 CET	80	49905	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:15.114074945 CET	80	49905	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:15.340719938 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:15.393507957 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.296793938 CET	8080	49899	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:16.296961069 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.297012091 CET	49899	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.320326090 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:16.362277031 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.379281044 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.416594982 CET	8080	49899	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:16.501610041 CET	8080	49911	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:16.501703024 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.518606901 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.519340992 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:16.642328024 CET	8080	49911	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:16.642991066 CET	8080	49911	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.351082087 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.393528938 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.579515934 CET	80	49905	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.579621077 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.579694033 CET	49905	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.582051039 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.699407101 CET	80	49905	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.701630116 CET	80	49912	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.701736927 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.721698046 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.723618984 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:17.842396021 CET	80	49912	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:17.844108105 CET	80	49912	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:18.366714001 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:18.424765110 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.113647938 CET	8080	49911	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:19.113728046 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.113811016 CET	49911	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.222660065 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.233716965 CET	8080	49911	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:19.342653990 CET	8080	49918	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:19.342720985 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.362493038 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.362509966 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.397140026 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:19.440402985 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:19.482055902 CET	8080	49918	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:19.482129097 CET	8080	49918	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.296376944 CET	80	49912	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.298398972 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.304487944 CET	49912	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.319355965 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.397692919 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.423993111 CET	80	49912	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.439162016 CET	80	49920	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.439238071 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.443336964 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.456130981 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.456166029 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:20.575764894 CET	80	49920	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:20.575788975 CET	80	49920	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:21.412565947 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:21.456207037 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:21.969253063 CET	8080	49918	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:21.969329119 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:21.969543934 CET	49918	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:22.067831039 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:22.089217901 CET	8080	49918	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:22.187571049 CET	8080	49925	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:22.187813997 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:22.206127882 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:22.206262112 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:22.325877905 CET	8080	49925	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:22.325895071 CET	8080	49925	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:22.428117037 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:22.475327015 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:23.473956108 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:23.518533945 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:24.459765911 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:24.502906084 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:24.812618017 CET	8080	49925	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:24.812716961 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:24.812774897 CET	49925	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:24.909902096 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:24.932796955 CET	8080	49925	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:25.029957056 CET	8080	49934	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:25.030047894 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:25.050029039 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:25.050040960 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:25.174546957 CET	8080	49934	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:25.174606085 CET	8080	49934	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:25.475431919 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:25.518579960 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:26.490833044 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:26.534209967 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.506443024 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:27.549849033 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.646388054 CET	8080	49934	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:27.646486998 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.646647930 CET	49934	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.753787041 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.766318083 CET	8080	49934	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:27.873408079 CET	8080	49941	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:27.873570919 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.893620014 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:27.893620014 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:28.015486956 CET	8080	49941	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:28.015505075 CET	8080	49941	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:28.522239923 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:28.565424919 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:29.537472963 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:29.581157923 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.528481960 CET	8080	49941	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:30.528642893 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.528814077 CET	49941	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.553248882 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:30.596672058 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.598383904 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.648372889 CET	8080	49941	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:30.718432903 CET	8080	49947	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:30.718506098 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.737634897 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.737684011 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:30.862555981 CET	8080	49947	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:30.862603903 CET	8080	49947	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:31.571211100 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:31.612380028 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:32.584562063 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:32.628005981 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.341546059 CET	8080	49947	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:33.341641903 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.341641903 CET	49947	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.445641041 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.462726116 CET	8080	49947	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:33.570487022 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:33.573527098 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.594904900 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.594904900 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.600555897 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:33.643559933 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:33.716099977 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:33.716120005 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:34.617156982 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:34.659229040 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:34.802917004 CET	80	49920	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:34.803009987 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:34.803066969 CET	49920	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:34.863401890 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:34.922743082 CET	80	49920	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:34.983124971 CET	80	49959	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:34.983191967 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:35.003022909 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:35.003119946 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:35.123790026 CET	80	49959	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:35.123827934 CET	80	49959	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:35.631339073 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:35.674817085 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.560404062 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.560596943 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.560796976 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.617728949 CET	49955	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.647366047 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.690427065 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.698626995 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.739130974 CET	8080	49955	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.820581913 CET	8080	49964	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.821719885 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.832876921 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.832878113 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:36.953737974 CET	8080	49964	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:36.953793049 CET	8080	49964	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.582288980 CET	80	49959	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.582364082 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.582422018 CET	49959	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.597928047 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.662849903 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.706058979 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.708726883 CET	80	49959	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.724416018 CET	80	49967	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.725240946 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.737422943 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.737442017 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:37.858169079 CET	80	49967	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:37.858200073 CET	80	49967	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:38.678354025 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:38.737310886 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:39.427172899 CET	8080	49964	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:39.427242994 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:39.694668055 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:39.737293959 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.312211990 CET	80	49967	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.312274933 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.493418932 CET	49967	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.493624926 CET	49964	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.550611019 CET	49976	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.566227913 CET	49977	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.613471985 CET	80	49967	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.613543034 CET	8080	49964	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.671217918 CET	80	49976	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.671355009 CET	49976	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.686021090 CET	8080	49977	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.686100006 CET	49977	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.690732002 CET	49976	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.690732002 CET	49976	80	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.706233025 CET	49977	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.706233025 CET	49977	8080	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.709610939 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.752942085 CET	49746	5651	192.168.2.4	101.99.91.150
Dec 25, 2024 17:16:40.810753107 CET	80	49976	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.810937881 CET	80	49976	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.826646090 CET	8080	49977	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:40.826698065 CET	8080	49977	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:41.729816914 CET	5651	49746	101.99.91.150	192.168.2.4
Dec 25, 2024 17:16:41.784177065 CET	49746	5651	192.168.2.4	101.99.91.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:14:45.749666929 CET	64230	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 25, 2024 17:14:35.974242926 CET	192.168.2.4	8.8.8.8	4d5a	Echo
Dec 25, 2024 17:14:36.097138882 CET	8.8.8.8	192.168.2.4	555a	Echo Reply
Dec 25, 2024 17:14:37.088776112 CET	192.168.2.4	8.8.8.8	4d59	Echo
Dec 25, 2024 17:14:37.211051941 CET	8.8.8.8	192.168.2.4	5559	Echo Reply
Dec 25, 2024 17:14:38.216187954 CET	192.168.2.4	8.8.8.8	4d58	Echo
Dec 25, 2024 17:14:38.342116117 CET	8.8.8.8	192.168.2.4	5558	Echo Reply
Dec 25, 2024 17:14:40.126086950 CET	192.168.2.4	8.8.8.8	4d57	Echo
Dec 25, 2024 17:14:40.248972893 CET	8.8.8.8	192.168.2.4	5557	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 17:14:45.749666929 CET	192.168.2.4	1.1.1.1	0x8de2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 17:14:46.061147928 CET	1.1.1.1	192.168.2.4	0x8de2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 25, 2024 17:14:56.597717047 CET	1.1.1.1	192.168.2.4	0x6814	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 25, 2024 17:14:56.597717047 CET	1.1.1.1	192.168.2.4	0x6814	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:14:56.597717047 CET	1.1.1.1	192.168.2.4	0x6814	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:14:56.597717047 CET	1.1.1.1	192.168.2.4	0x6814	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:14:56.597717047 CET	1.1.1.1	192.168.2.4	0x6814	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:14:52.001658916 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:14:52.001738071 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49752	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:14:55.209120035 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:14:55.209196091 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:14:58.159271955 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:14:58.159271955 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49758	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:00.831003904 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:00.831135988 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49759	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:04.378006935 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:04.378225088 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:07.175193071 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:07.175271034 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49763	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:09.909116030 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:09.909116030 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49765	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:12.753336906 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:12.753405094 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49767	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:15.487299919 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:15.487299919 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49769	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:18.221663952 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:18.221664906 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49771	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:20.956034899 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:20.956034899 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49773	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:23.690557957 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:23.690557957 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49775	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:26.424880028 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:26.424896002 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49777	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:29.394898891 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:29.394944906 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49780	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:32.112374067 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:32.112394094 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49788	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:35.878221989 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:35.878221989 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Dec 25, 2024 17:15:36.237473011 CET	8	OUT	Data Raw: 00 00 00 01 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49795	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:39.003189087 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:39.003200054 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49806	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:41.737255096 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:41.737270117 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49813	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:44.471656084 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:44.471656084 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49821	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:47.348803043 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:47.348819971 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49828	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:50.001144886 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:50.001508951 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49839	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:52.909394026 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:52.909413099 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49846	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:55.737339020 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:55.737358093 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49854	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:15:58.471745014 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:15:58.471756935 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49865	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:01.206890106 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:01.206890106 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49872	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:03.940541983 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:03.940541983 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49879	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:06.675105095 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:06.675117970 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49887	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:09.518974066 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:09.518999100 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49898	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:12.252991915 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:12.253034115 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49905	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:14.987363100 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:14.987413883 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49912	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:17.721698046 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:17.723618984 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49920	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:20.456130981 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:20.456166029 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49959	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:35.003022909 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:35.003119946 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49967	101.99.91.150	80	8532	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:37.737422943 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:37.737442017 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49976	101.99.91.150	80

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:16:40.690732002 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Dec 25, 2024 17:16:40.690732002 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Target ID:	0
Start time:	11:14:32
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\0442.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0442.pdf.exe"
Imagebase:	0x7ff600fc0000
File size:	11'409'543 bytes
MD5 hash:	4F6B2B9EE57C50D6C505D0CDADA4803E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:14:33
Start date:	25/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ms.msi" /qn
Imagebase:	0x7ff607150000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:14:33
Start date:	25/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\start.bat" "
Imagebase:	0x7ff750960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:14:33
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:14:33
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:14:33
Start date:	25/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff607150000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:14:34
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\doc2.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:14:34
Start date:	25/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 8.8.8.8
Imagebase:	0x7ff6b9bd0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:14:36
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:14:36
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:14:36
Start date:	25/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,18215150213972139035,17261459285525738276,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:14:44
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000C.00000000.1785110285.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:14:44
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000D.00000000.1792887318.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:14:46
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:14:46
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:14:47
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:14:47
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:14:48
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:14:50
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	11:14:50
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	11:14:50
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:14:51
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:14:52
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:14:53
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:14:54
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:15:02
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:15:34
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:15:47
Start date:	25/12/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF600FEB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FC255C: GetDlgItem.USER32 ref: 00007FF600FC25AC
Part of subcall function 00007FF600FC255C: SetWindowTextW.USER32 ref: 00007FF600FC25C8

EndDialog.USER32 ref: 00007FF600FEB2D0
SetDlgItemTextW.USER32 ref: 00007FF600FEB320
GetMessageW.USER32 ref: 00007FF600FEB350
IsDialogMessageW.USER32 ref: 00007FF600FEB369
TranslateMessage.USER32 ref: 00007FF600FEB37B
DispatchMessageW.USER32 ref: 00007FF600FEB389
EndDialog.USER32 ref: 00007FF600FEB3D3
GetDlgItem.USER32 ref: 00007FF600FEB410
SendMessageW.USER32 ref: 00007FF600FEB431
SendMessageW.USER32 ref: 00007FF600FEB449
SetFocus.USER32 ref: 00007FF600FEB452
GetLastError.KERNEL32 ref: 00007FF600FEB634
GetLastError.KERNEL32 ref: 00007FF600FEB665
GetTickCount.KERNEL32 ref: 00007FF600FEB68B
GetLastError.KERNEL32 ref: 00007FF600FEB6F5
GetCommandLineW.KERNEL32 ref: 00007FF600FEB841
CreateFileMappingW.KERNEL32 ref: 00007FF600FEB900
MapViewOfFile.KERNEL32 ref: 00007FF600FEB923
Sleep.KERNEL32 ref: 00007FF600FEB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF600FEB9DF
CloseHandle.KERNEL32 ref: 00007FF600FEB9E8
SetDlgItemTextW.USER32 ref: 00007FF600FEBCDE
DialogBoxParamW.USER32 ref: 00007FF600FEC0D7
EndDialog.USER32 ref: 00007FF600FEC0EF
EnableWindow.USER32 ref: 00007FF600FEC2A6
SendMessageW.USER32 ref: 00007FF600FEC2F8
ShellExecuteExW.SHELL32 ref: 00007FF600FEB95B

Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB67
Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB80

SendMessageW.USER32 ref: 00007FF600FEBEC3
SendDlgItemMessageW.USER32 ref: 00007FF600FEBEEA
GetDlgItem.USER32 ref: 00007FF600FEBEF8
SendMessageW.USER32 ref: 00007FF600FEBF12
GetDlgItem.USER32 ref: 00007FF600FEBF4F
SetDlgItemTextW.USER32 ref: 00007FF600FEBFEC
SetDlgItemTextW.USER32 ref: 00007FF600FEC004
SetDlgItemTextW.USER32 ref: 00007FF600FEC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEC381
SendDlgItemMessageW.USER32 ref: 00007FF600FEC449
EndDialog.USER32 ref: 00007FF600FEC463
GetDlgItem.USER32 ref: 00007FF600FEC491
SetFocus.USER32 ref: 00007FF600FEC49A
SendDlgItemMessageW.USER32 ref: 00007FF600FEC53E
FindFirstFileW.KERNEL32 ref: 00007FF600FEC562
FindClose.KERNEL32 ref: 00007FF600FEC68A
SendDlgItemMessageW.USER32 ref: 00007FF600FEC7AF

Part of subcall function 00007FF600FC129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FECAC7

Strings

LICENSEDLG, xrefs: 00007FF600FEC0C9
%s %s, xrefs: 00007FF600FEC6D9, 00007FF600FEC946
runas, xrefs: 00007FF600FEB7C9
p, xrefs: 00007FF600FEB7AB
REPLACEFILEDLG, xrefs: 00007FF600FEC3D3
@, xrefs: 00007FF600FEB7B6
winrarsfxmappingfile.tmp, xrefs: 00007FF600FEB8E0
STARTDLG, xrefs: 00007FF600FEB1CA
__tmp_rar_sfx_access_check_, xrefs: 00007FF600FEB6A9
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF600FEB799

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 9a17fb0a367c8f41df10969568811eb98f7642249842cc7a5319212f9cbedbf3
Instruction ID: 018811101773dab1472ca33632e094df38b001a89416b743ff044da97e620342
Opcode Fuzzy Hash: 9a17fb0a367c8f41df10969568811eb98f7642249842cc7a5319212f9cbedbf3
Instruction Fuzzy Hash: 7DD2B322A0C7C2A1EB20DB25E8552FA6361FF85780F604535DE8E877AAEF3CE545D344

Function 00007FF600FECE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF600FED5F3
SendMessageW.USER32 ref: 00007FF600FED626
SendMessageW.USER32 ref: 00007FF600FED655
MoveFileW.KERNEL32 ref: 00007FF600FEDB4B
MoveFileExW.KERNEL32 ref: 00007FF600FEDB69
GetTempPathW.KERNEL32 ref: 00007FF600FEDC49

Part of subcall function 00007FF600FC1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1FFB

EndDialog.USER32 ref: 00007FF600FEDFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FEEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FEEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FEEF73

Strings

ProgramFilesDir, xrefs: 00007FF600FED4F0
@set:user, xrefs: 00007FF600FEDD96, 00007FF600FEDDA5
MAX, xrefs: 00007FF600FEEA82, 00007FF600FEEA91
MIN, xrefs: 00007FF600FEEAE5, 00007FF600FEEAF4
.lnk, xrefs: 00007FF600FEE406, 00007FF600FEE415
.tmp, xrefs: 00007FF600FEDA85
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF600FED501
HIDE, xrefs: 00007FF600FEE9E5, 00007FF600FEE9F4
lnk, xrefs: 00007FF600FEE3CA, 00007FF600FEE3D9
<br>, xrefs: 00007FF600FED6DA, 00007FF600FED6E9

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 22536870ed44e5dbbaf540d151aa187c5a891d92fbde2893a6fdd8757bd3f256
Instruction ID: 1f8ba29bd07a05adc4db7d44c23bbb944db7074073de8c771596ab3b5e4b9d88
Opcode Fuzzy Hash: 22536870ed44e5dbbaf540d151aa187c5a891d92fbde2893a6fdd8757bd3f256
Instruction Fuzzy Hash: 7B139C22B08B82A9EB10DF64D8402EC27A1FB41798F601536DE5D97BEDEF38E595D340

Function 00007FF600FF0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF600FDDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE018
Part of subcall function 00007FF600FDDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE030
Part of subcall function 00007FF600FDDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE05D

Part of subcall function 00007FF600FD62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF600FD62F2
Part of subcall function 00007FF600FD62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF600FD632C

Part of subcall function 00007FF600FE946C: OleInitialize.OLE32 ref: 00007FF600FE9486
Part of subcall function 00007FF600FE946C: SHGetMalloc.SHELL32 ref: 00007FF600FE94D4

GetCommandLineW.KERNEL32 ref: 00007FF600FF096E
OpenFileMappingW.KERNEL32 ref: 00007FF600FF0A07
MapViewOfFile.KERNEL32 ref: 00007FF600FF0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF600FF0A46
MapViewOfFile.KERNEL32 ref: 00007FF600FF0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF600FF0ACA
CloseHandle.KERNEL32 ref: 00007FF600FF0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF600FF0BAD
GetLocalTime.KERNEL32 ref: 00007FF600FF0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FF0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF600FF0C26
GetModuleHandleW.KERNEL32 ref: 00007FF600FF0C2E
LoadIconW.USER32 ref: 00007FF600FF0C4D
DialogBoxParamW.USER32 ref: 00007FF600FF0CB6
Sleep.KERNEL32 ref: 00007FF600FF0CE6
DeleteObject.GDI32 ref: 00007FF600FF0D0D
DeleteObject.GDI32 ref: 00007FF600FF0D1F
CloseHandle.KERNEL32 ref: 00007FF600FF0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF0DE3

Part of subcall function 00007FF600FEFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF600FEFD43
Part of subcall function 00007FF600FEFD0C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF600FEFDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF600FF0C02
sfxstime, xrefs: 00007FF600FF0C1F
sfxname, xrefs: 00007FF600FF0B9B
STARTDLG, xrefs: 00007FF600FF0CA5
winrarsfxmappingfile.tmp, xrefs: 00007FF600FF09F9

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction ID: 47200f50cf0e5587b09e7ac2090ee3e33dd3d137aee21164a0bf4fe9a1cabf9f
Opcode Fuzzy Hash: 7fb843965e060d2caf1f274bd47349aa60f49b36b68f6f054b76b7ae27a5abf6
Instruction Fuzzy Hash: 0E127D61A1CB8291EB10DF24E8452B97365FF84794F604236DE9E87BAAEF7CE540D304

Function 00007FF600FDA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FDA504

Part of subcall function 00007FF600FE0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF600FE0F99

SetDlgItemTextW.USER32 ref: 00007FF600FDA573
GetWindowRect.USER32 ref: 00007FF600FDA5AD
GetClientRect.USER32 ref: 00007FF600FDA5BB
GetWindowLongPtrW.USER32 ref: 00007FF600FDA66C
GetWindowRect.USER32 ref: 00007FF600FDA6B2
SetWindowTextW.USER32 ref: 00007FF600FDA6EC
GetSystemMetrics.USER32 ref: 00007FF600FDA6F7
GetWindow.USER32 ref: 00007FF600FDA708
GetWindowRect.USER32 ref: 00007FF600FDA746
GetWindow.USER32 ref: 00007FF600FDA808

Strings

CAPTION, xrefs: 00007FF600FDA6CF
$%s:, xrefs: 00007FF600FDA4EF

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 28462578de87106489345943b026c5425666037f961e1c3e58d447153243cf1f
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 0A91D932B1C6418AE714DF39E800669B7A1FB85784F645536EE8E97B98DF3CE805CB00

Function 00007FF600FE8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF600FE863D
SizeofResource.KERNEL32 ref: 00007FF600FE8659
LoadResource.KERNEL32 ref: 00007FF600FE8673
LockResource.KERNEL32 ref: 00007FF600FE8685
GlobalAlloc.KERNELBASE ref: 00007FF600FE86A6
GlobalLock.KERNEL32 ref: 00007FF600FE86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF600FE86E8
GdipAlloc.GDIPLUS ref: 00007FF600FE86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF600FE8769
GlobalUnlock.KERNEL32 ref: 00007FF600FE878C
GlobalFree.KERNEL32 ref: 00007FF600FE8795

Strings

PNG, xrefs: 00007FF600FE862F

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: d8fab4350f8b1cc445fcf0cbf214e473a6f4447e385bdbf34c7b8b127722e177
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: CC412825A1DB4692EF059F56D84437963A0BF88BD0F284435DE4E873A8EF7CE849D300

Function 00007FF600FCF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1263

Strings

__tmp_reference_source_, xrefs: 00007FF600FCFCCF, 00007FF600FCFCDE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction ID: ca6ea9eb8a62316ef126c95c6909fdb50858668fe94881680b948416e17a5e57
Opcode Fuzzy Hash: ee1b9b2f793652c4fffa685adae4afd38ebba44b70748007b51654422c3c5d5b
Instruction Fuzzy Hash: E1E28662A0C6C2A2EA64CB25E1457FEA762FB81740F604136DF9D877A9CF3CE455E700

Function 00007FF600FC4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC5E1C

Strings

CMT, xrefs: 00007FF600FC59B2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: e332826224c26e08b8897dde0b291f1f93ab3e52299fc2a58a734e8ff3d1849b
Instruction ID: c69468e5b501ed43601d2de354cf6a8f5263adeac7915b82ceb20ba666726a51
Opcode Fuzzy Hash: e332826224c26e08b8897dde0b291f1f93ab3e52299fc2a58a734e8ff3d1849b
Instruction Fuzzy Hash: 85E20222B0CA82A6EB18DB65D6516FD67A1FB41784F640836CE4E8379ACF3CF095D300

Function 00007FF600FD40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF600FD410B
FindFirstFileW.KERNEL32 ref: 00007FF600FD415E
GetLastError.KERNEL32 ref: 00007FF600FD41AF
FindNextFileW.KERNEL32 ref: 00007FF600FD41D7
GetLastError.KERNEL32 ref: 00007FF600FD41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD4315

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: 5ee2e0c9d02a96321950b1dd843d19863b05b1ec6e3c1fb9306de2bc3c2e6525
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: 35618462A0C64692EA11DF28E84127D6362FB957A4F205332EEAD837DDDF3CE584D700

Function 00007FF600FC5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF600FC59B2, 00007FF600FC675B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction ID: 0e5b759b4e74493a0b6903b2b2a7862afd4b19c8846457e839f31591b27aced7
Opcode Fuzzy Hash: 1483503f4f6562bc116dab0f55c891e212737330d95d7192c6dc5e801ab4a3f4
Instruction Fuzzy Hash: 7042DF22B0C682A6EB18DB74D2526FD67A1EB41384F240536DF5ED379ADF38E519E300

Function 00007FF600FE1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction ID: 7a6482060bf044a3eefa89f4c01cdea2365a522338eed8a84228f0d4f4da7b39
Opcode Fuzzy Hash: 6a2ba48437b82e373fac81338819d40f47a0019a50d197aab006f7cc31990992
Instruction Fuzzy Hash: C5E1C162A0C2C29AEB64CF29A0442BD7791FB44748F25413ADF8ED778AEE3CF5419704

Function 00007FF600FE3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction ID: c5075546ec40e313f2c643388d9682cdb3ce42993ace5832ba84d6645ba3287b
Opcode Fuzzy Hash: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction Fuzzy Hash: AFB1C0A2B09BC9A2DE58CA66D50CAE97391BB45FC4F588036DE0D87749EF3CE255D300

Function 00007FF600FD4928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction ID: 30214214a2d1fbc05b57468d7e8c5c0f62c0ef1ed896b7d21dff8acd06d1b4e4
Opcode Fuzzy Hash: 2cb8b9ec6f6f726b57ae810d2a963647076a0ed4099b9c3b4f35ab7767efdb68
Instruction Fuzzy Hash: F1412722B19A9297FB64DF22A91077A2253FBC4788F244032DE4E87798DE3CF442D704

Function 00007FF600FDDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE05D
CreateFileW.KERNEL32 ref: 00007FF600FDE3F0
SetFilePointer.KERNEL32 ref: 00007FF600FDE40E
ReadFile.KERNEL32 ref: 00007FF600FDE436

Part of subcall function 00007FF600FDDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF600FDDDDF

CompareStringW.KERNELBASE ref: 00007FF600FDE559
CloseHandle.KERNEL32 ref: 00007FF600FDE4F3

Part of subcall function 00007FF600FC1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1FFB

Part of subcall function 00007FF600FD51A4: GetVersionExW.KERNEL32 ref: 00007FF600FD51D5

Part of subcall function 00007FF600FDDFD0: LoadLibraryExW.KERNELBASE ref: 00007FF600FDDEFF
Part of subcall function 00007FF600FDDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDDFB5
Part of subcall function 00007FF600FDDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDDFBB
Part of subcall function 00007FF600FDDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDDFC1
Part of subcall function 00007FF600FDDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF600FDE7AA
ExitProcess.KERNEL32 ref: 00007FF600FDE7BB

Strings

oleaccrc.dll, xrefs: 00007FF600FDE1E9
netutils.dll, xrefs: 00007FF600FDE283
DXGIDebug.dll, xrefs: 00007FF600FDE086, 00007FF600FDE5B6
dsrole.dll, xrefs: 00007FF600FDE37F
cabinet.dll, xrefs: 00007FF600FDE1DB
wkscli.dll, xrefs: 00007FF600FDE2E5
lpk.dll, xrefs: 00007FF600FDE0D3
mlang.dll, xrefs: 00007FF600FDE2BB
cscapi.dll, xrefs: 00007FF600FDE22F
mpr.dll, xrefs: 00007FF600FDE291
SetDefaultDllDirectories, xrefs: 00007FF600FDE053
SSPICLI.DLL, xrefs: 00007FF600FDE09C
rsaenh.dll, xrefs: 00007FF600FDE0A7
dwmapi.dll, xrefs: 00007FF600FDE0BD, 00007FF600FDE661
ws2_32.dll, xrefs: 00007FF600FDE0FF
cryptbase.dll, xrefs: 00007FF600FDE0C8
SetDllDirectoryW, xrefs: 00007FF600FDE026
RpcRtRemote.dll, xrefs: 00007FF600FDE363
clbcatq.dll, xrefs: 00007FF600FDE0E9
linkinfo.dll, xrefs: 00007FF600FDE347
setupapi.dll, xrefs: 00007FF600FDE141
devrtl.dll, xrefs: 00007FF600FDE29F
samlib.dll, xrefs: 00007FF600FDE2D7
aclui.dll, xrefs: 00007FF600FDE371
netapi32.dll, xrefs: 00007FF600FDE16B
cryptui.dll, xrefs: 00007FF600FDE1A3
psapi.dll, xrefs: 00007FF600FDE115
srvcli.dll, xrefs: 00007FF600FDE221
sfc_os.dll, xrefs: 00007FF600FDE091
shell32.dll, xrefs: 00007FF600FDE1BF
dfscli.dll, xrefs: 00007FF600FDE2F3
crypt32.dll, xrefs: 00007FF600FDE187
ntshrui.dll, xrefs: 00007FF600FDE12B
wintrust.dll, xrefs: 00007FF600FDE1B1
slc.dll, xrefs: 00007FF600FDE23D
browcli.dll, xrefs: 00007FF600FDE301
ntmarta.dll, xrefs: 00007FF600FDE1F7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF600FDE73B
dnsapi.DLL, xrefs: 00007FF600FDE259
dhcpcsvc.dll, xrefs: 00007FF600FDE32B
WindowsCodecs.dll, xrefs: 00007FF600FDE213
uxtheme.dll, xrefs: 00007FF600FDE66D
atl.dll, xrefs: 00007FF600FDE136
dhcpcsvc6.dll, xrefs: 00007FF600FDE31D
ws2help.dll, xrefs: 00007FF600FDE10A
profapi.dll, xrefs: 00007FF600FDE205
apphelp.dll, xrefs: 00007FF600FDE14F
rasadhlp.dll, xrefs: 00007FF600FDE30F
samcli.dll, xrefs: 00007FF600FDE2C9
UXTheme.dll, xrefs: 00007FF600FDE0B2
WINNSI.DLL, xrefs: 00007FF600FDE275
msasn1.dll, xrefs: 00007FF600FDE195
cryptsp.dll, xrefs: 00007FF600FDE355
propsys.dll, xrefs: 00007FF600FDE2AD
usp10.dll, xrefs: 00007FF600FDE0DE
secur32.dll, xrefs: 00007FF600FDE1CD
XmlLite.dll, xrefs: 00007FF600FDE339
comres.dll, xrefs: 00007FF600FDE0F4
iphlpapi.DLL, xrefs: 00007FF600FDE267
version.dll, xrefs: 00007FF600FDE07B
shdocvw.dll, xrefs: 00007FF600FDE179
imageres.dll, xrefs: 00007FF600FDE24B
ieframe.dll, xrefs: 00007FF600FDE120
kernel32, xrefs: 00007FF600FDE011
userenv.dll, xrefs: 00007FF600FDE15D
peerdist.dll, xrefs: 00007FF600FDE38D

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction ID: dd688c66cb6b4ab03ad98d48625d2d9c4e2f7f563597dce4bc66c39fcfc23180
Opcode Fuzzy Hash: 19926894803355f4926a5d38047f13a95aa4f57e947c60c8a04cc60affe7caae
Instruction Fuzzy Hash: 15322F35A09F82A5EB129F64E8401E933A5FF45358F604236DE8E877AAEF3CD255C344

Function 00007FF600FD98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FD8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FD9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FDA435

Part of subcall function 00007FF600FE0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF600FE0B44), ref: 00007FF600FE0BE9

Strings

MENU, xrefs: 00007FF600FD9DD9
RTL, xrefs: 00007FF600FD9F2E
DIRECTION, xrefs: 00007FF600FD9DE5
, xrefs: 00007FF600FD9DF9
*messages***, xrefs: 00007FF600FD9BC6
,, xrefs: 00007FF600FD9FAA
STRINGS, xrefs: 00007FF600FD9DC1
@%s:, xrefs: 00007FF600FD9F57
*messages***, xrefs: 00007FF600FD9C04
$%s:, xrefs: 00007FF600FD9F50
DIALOG, xrefs: 00007FF600FD9DCD

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction ID: 656f847cb4896f2868e0daf622a454a661f552ee9cdbbf025ac8ec24ae605751
Opcode Fuzzy Hash: c1941742baf2d9c3be52f390a0a923855bad3b4b9f203786c8d0fad0fa7aba42
Instruction Fuzzy Hash: 4662BC22A1DA82A5EB10DF65C4482BD3366FB40788FA05132DE4E8779DEF7CE545E341

Function 00007FF600FF1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF600FF1558: DloadProtectSection.DELAYIMP ref: 00007FF600FF15C9

RaiseException.KERNEL32 ref: 00007FF600FF19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF600FF1993

Part of subcall function 00007FF600FF1868: DloadProtectSection.DELAYIMP ref: 00007FF600FF18C7

LoadLibraryExA.KERNELBASE ref: 00007FF600FF1A46
GetLastError.KERNEL32 ref: 00007FF600FF1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF600FF1A86
RaiseException.KERNEL32 ref: 00007FF600FF1A9A

Strings

H, xrefs: 00007FF600FF1974

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 186fd2eafbd429b5a13572d335fdf497b908df4d46482d350c30cbda0374e735
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 4F914822E09B52DAEB11CFA5D8446B833A9BF48B98F248535DE4E97758EF38E445D300

Function 00007FF600FEF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF600FEF747
ShowWindow.USER32 ref: 00007FF600FEF786
GetExitCodeProcess.KERNEL32 ref: 00007FF600FEF7BD
CloseHandle.KERNEL32 ref: 00007FF600FEF7E7
ShowWindow.USER32 ref: 00007FF600FEF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEF8FB

Strings

.exe, xrefs: 00007FF600FEF7F2
Install, xrefs: 00007FF600FEF684
p, xrefs: 00007FF600FEF529
.inf, xrefs: 00007FF600FEF675

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction ID: 85db3fde12f389ffb98a227791669dad7ba59b50d3251d1245b520da14cd8d34
Opcode Fuzzy Hash: bd083846a701d2a936ecc778425380adf73900159b5be9ae941c3623c510174f
Instruction Fuzzy Hash: 9BC17C22F1CB82A5FB10DB25D94027923B1AF95B84F644035DE4E877A9EF3CE959D304

Function 00007FF600FEF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF600FEAE1C: PeekMessageW.USER32 ref: 00007FF600FEAE32
Part of subcall function 00007FF600FEAE1C: GetMessageW.USER32 ref: 00007FF600FEAE49
Part of subcall function 00007FF600FEAE1C: IsDialogMessageW.USER32 ref: 00007FF600FEAE60
Part of subcall function 00007FF600FEAE1C: TranslateMessage.USER32 ref: 00007FF600FEAE6F
Part of subcall function 00007FF600FEAE1C: DispatchMessageW.USER32 ref: 00007FF600FEAE7A

GetDlgItem.USER32 ref: 00007FF600FEF0E3
ShowWindow.USER32 ref: 00007FF600FEF109
SendMessageW.USER32 ref: 00007FF600FEF11E
SendMessageW.USER32 ref: 00007FF600FEF136
SendMessageW.USER32 ref: 00007FF600FEF157
SendMessageW.USER32 ref: 00007FF600FEF173
SendMessageW.USER32 ref: 00007FF600FEF1B6
SendMessageW.USER32 ref: 00007FF600FEF1D4
SendMessageW.USER32 ref: 00007FF600FEF1E8
SendMessageW.USER32 ref: 00007FF600FEF212
SendMessageW.USER32 ref: 00007FF600FEF22A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: dacbe28c41cdd6fb245b1a891c02f83a9688d148c033fac3c1a3c5749d218b15
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: 5541E531B1864286F700DF61E814BAA3360FB85B98F644135DD4F8BB99CF3DD8498748

Function 00007FF600FCEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF572

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction ID: 1fdcbaf1ed2bc43cff3847fb2991d8f583e32d80230691a1a8e939c9c395240d
Opcode Fuzzy Hash: e994a9db728abc9e3b7c2f1aeddd0c1bbb8b4fdc17eb45be45aeabee48c93372
Instruction Fuzzy Hash: B012DE62F0CB42A4EB10DB64D5466BD6362AB457A8F600632DE5C97BDEDF3CE189D300

Function 00007FF600FD24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF600FD259B
GetLastError.KERNEL32 ref: 00007FF600FD25AE
CreateFileW.KERNEL32 ref: 00007FF600FD260E
GetLastError.KERNEL32 ref: 00007FF600FD2617
SetFileTime.KERNEL32 ref: 00007FF600FD26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD2736

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: bf192422528de077199ff503e4f33e94d8cfac8aec57b01a6e4eac20f532ca57
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: 7E61F272A0874195E7608F29E50036E67B2BB947A8F201335DFAA43BD8CF3DD054D744

Function 00007FF600FEFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF600FEFD43
SetEnvironmentVariableW.KERNELBASE ref: 00007FF600FEFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEFE1B

Strings

sfxpar, xrefs: 00007FF600FEFDB5
sfxcmd, xrefs: 00007FF600FEFD3C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 47f739bc4788db9c72f522fd32e7144b67cf6dc14da81f271a3ad5b6803321ab
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: 1C316D72F18A4694EB14DF69E8841AC3371FB48B98F241532DE5E977A9DF38E045C344

Function 00007FF600FEB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF600FEB02A
GetObjectW.GDI32 ref: 00007FF600FEB05B
DeleteObject.GDI32 ref: 00007FF600FEB095
DeleteObject.GDI32 ref: 00007FF600FEB0C5

Part of subcall function 00007FF600FE8624: FindResourceW.KERNEL32 ref: 00007FF600FE863D
Part of subcall function 00007FF600FE8624: SizeofResource.KERNEL32 ref: 00007FF600FE8659
Part of subcall function 00007FF600FE8624: LoadResource.KERNEL32 ref: 00007FF600FE8673
Part of subcall function 00007FF600FE8624: LockResource.KERNEL32 ref: 00007FF600FE8685
Part of subcall function 00007FF600FE8624: GlobalAlloc.KERNELBASE ref: 00007FF600FE86A6
Part of subcall function 00007FF600FE8624: GlobalLock.KERNEL32 ref: 00007FF600FE86BB
Part of subcall function 00007FF600FE8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF600FE86E8
Part of subcall function 00007FF600FE8624: GdipAlloc.GDIPLUS ref: 00007FF600FE86FE
Part of subcall function 00007FF600FE8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF600FE8769
Part of subcall function 00007FF600FE8624: GlobalUnlock.KERNEL32 ref: 00007FF600FE878C
Part of subcall function 00007FF600FE8624: GlobalFree.KERNEL32 ref: 00007FF600FE8795

Strings

], xrefs: 00007FF600FEB063

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 42be106dbd9c84ef89b72d2a7cebcbc0e075e1c2ce211e4897797b4d6bb5cc54
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 58116321B0D68355FA64AB21E65437A5291AF88BC0F280034DE5E87B9DEF3CFC059600

Function 00007FF600FEAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF600FEAE32
GetMessageW.USER32 ref: 00007FF600FEAE49
IsDialogMessageW.USER32 ref: 00007FF600FEAE60
TranslateMessage.USER32 ref: 00007FF600FEAE6F
DispatchMessageW.USER32 ref: 00007FF600FEAE7A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 375fe74a2c62a1e8c2a24bbe604f3499f058a34fd5268f483872852d190d7f25
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: 11F0FF36B3858292FB509B21E895A762361FFD0B05FA45431E98FC2954DF3CE908CB04

Function 00007FF600FE91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF600FE9211
SHAutoComplete.SHLWAPI ref: 00007FF600FE9255

Part of subcall function 00007FF600FE13C4: CompareStringW.KERNEL32 ref: 00007FF600FE13E3

FindWindowExW.USER32 ref: 00007FF600FE923F

Strings

EDIT, xrefs: 00007FF600FE921B, 00007FF600FE9233

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: e4f0631737424c10aac76aa74573020eb1074a79519cc38caf46945040183f77
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 8D018161B1CB8791FF209B21E8103F66390BF98744FA40031CD8E87798EE7CE149D650

Function 00007FF600FD2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF600FD8C9A), ref: 00007FF600FD2D22
WriteFile.KERNEL32 ref: 00007FF600FD2D6C
WriteFile.KERNELBASE ref: 00007FF600FD2D9A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: 7c5a9dc40aacb9a18e08501ca136c9cde2a38328ec85d7abebd80c482d99f58e
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: B2512622B1CA42A2FB91CB25D44477A6322FF94B90F644132EE4E87B98DF3CE485D340

Function 00007FF600FF03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF600FF0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF05CD

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction ID: 38a3b1cd1e71cad170e935da1052e6443f869e5cb9fb158e65cd837a0b802b7e
Opcode Fuzzy Hash: 34b731ebe9af3ba17aed105ea6cd5e0b01c3b8b12ff97f26908d03dc914b4b53
Instruction Fuzzy Hash: C451D162F58752A4FF009BA4D8452BD2326BF44BA4F684632DE1C97BDADFACE440D304

Function 00007FF600FD3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF600FD309D), ref: 00007FF600FD36CE
CreateDirectoryW.KERNEL32 ref: 00007FF600FD3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF600FD309D), ref: 00007FF600FD3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD37CE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 8c50e094574d60efd6cbd32698af117ce57c9c2367121af70e32b9649048c21f
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: 0131A4A2A0CA82A1EB609B25A44427D6352FF897A0F744232EF9DC37DDDF3CE5459601

Function 00007FF600FF2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF600FF2D7B

Part of subcall function 00007FF600FF27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF600FF281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF600FF2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF600FF2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF600FF2E51

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 65f66b193429c96397c584b16527210f00c5e9fd992c80eab4a0250736c9a7a8
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: CD315E21E8C20762FBA5AB6495123F92299AF40784F744435EE4ECB3DFDE2CB905E345

Function 00007FF600FD2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF600FD2927,?,00100000,?,00000001,00000000,00000000,?,00007FF600FD14C1), ref: 00007FF600FD2348
ReadFile.KERNELBASE ref: 00007FF600FD2367
GetLastError.KERNEL32 ref: 00007FF600FD239B
GetLastError.KERNEL32 ref: 00007FF600FD23BA

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: fd47afe261eee950f49c8b194a8444478b0142687f1e99b0f6d247174844d270
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 3B218421E0CA4291EBA09F15A40033D63A2FB65B94F344532DE9DC778CCF7CD885A791

Function 00007FF600FDE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FDECD8: ResetEvent.KERNEL32 ref: 00007FF600FDECF1
Part of subcall function 00007FF600FDECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF600FDED07

ReleaseSemaphore.KERNEL32 ref: 00007FF600FDE974
CloseHandle.KERNELBASE ref: 00007FF600FDE993
DeleteCriticalSection.KERNEL32 ref: 00007FF600FDE9AA
CloseHandle.KERNEL32 ref: 00007FF600FDE9B7

Part of subcall function 00007FF600FDEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF600FDE95F,?,?,?,00007FF600FD463A,?,?,?), ref: 00007FF600FDEA63
Part of subcall function 00007FF600FDEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF600FDE95F,?,?,?,00007FF600FD463A,?,?,?), ref: 00007FF600FDEA6E

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: c4dcfdfc5676dd1bd2df5f8f67b0551c58d48af34df1855a97cff2253d791d79
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 60014432A19A41E2E745EF21D55426D7331FB887C0F108032EB9E47615CF39E5B4C744

Function 00007FF600FDEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF600FDEAE0
SetThreadPriority.KERNEL32 ref: 00007FF600FDEB36

Strings

CreateThread failed, xrefs: 00007FF600FDEAEE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 1e68511fba2bf161cddc9694c499f9f1860b8b096ad2f1d394dad663672befcc
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 46116D31A0CA4291EB01EB10E8422B97361FB84788F648532EE8E8776DDF3CE985C744

Function 00007FF600FE946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FDDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF600FDDDDF

OleInitialize.OLE32 ref: 00007FF600FE9486
SHGetMalloc.SHELL32 ref: 00007FF600FE94D4

Strings

riched20.dll, xrefs: 00007FF600FE9475

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 9ebecf41b70fec617ee3f588d6de8ed72519c1415cbbf5d72a3bfb7df5caec34
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 68F04F71658A8182EB419F20F4541AAB3A0FF88754F604135EACE82754DF7CD549CB04

Function 00007FF600FE095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FE853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF600FE856C

Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB67
Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB80

Part of subcall function 00007FF600FC1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1FFB

Part of subcall function 00007FF600FC129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FF01C1
SendDlgItemMessageW.USER32 ref: 00007FF600FF01F2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction ID: 294d47674427a71722b232b1fc012c33f389e6d0a985d77b1ee69b3a01c8c7f5
Opcode Fuzzy Hash: 7d1f69911a00d0741de56b49c262a8841e6eb375053cbff927e1aaae2ee712c8
Instruction Fuzzy Hash: 1751D262F4D642A6FB10ABA5D4412FD2362AF85BC8F600636DE4D977DEDE2CE500D340

Function 00007FF600FC1744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC18A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF600FC18D4

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 033d1f2373e289fcea4600ec5fd98b8e281c8f6be3c6486de31ae0a2ea98365b
Instruction ID: cec949af41015b7012157719ff98acbc5fee724d5a649cb49f4c573a8f939f75
Opcode Fuzzy Hash: 033d1f2373e289fcea4600ec5fd98b8e281c8f6be3c6486de31ae0a2ea98365b
Instruction Fuzzy Hash: C2412261B0C645A1EA04DB12E641679A365FF05BE0F644A31DE7C87BDAEF7CE0A1D304

Function 00007FF600FD2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF600FD21CF
CreateFileW.KERNEL32 ref: 00007FF600FD223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD22D8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: 6e487e90591108c7e12ffaececb93cb0f7419ea1c562ff01d5193cdfc5e296af
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: CC41B172A0C78292EB608B15E44426973A2FB957B4F205336EFAD43BD9CF3CE4919744

Function 00007FF600FC23F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF600FC243E
GetWindowTextW.USER32 ref: 00007FF600FC2476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC2505

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: fa3aac84ba049256a147ca964ac989948286f03053954fed23a5ea7754a85f75
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: DC21A062A2CB8182EA249B65E94157AB364FB89BD0F244235EFDD43B99CF3CD190C740

Function 00007FF600FE1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FE205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FE2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FE2093

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction ID: 4560b2dbf878369ef852e1e9e69f64b7f259a424a105eeb1372965350926e40a
Opcode Fuzzy Hash: 5d5f35b7d0b1a8ec44982466ed86c266d3277025963138b758b7e20b27780546
Instruction Fuzzy Hash: 62317022A0D6C661FB649714E4443B963A4FB40B84F644532DB8C877EDEF7CEA86D301

Function 00007FF600FD3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF600FE07E1), ref: 00007FF600FD3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF600FD3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD3E1A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: bcb45812c59172312a8df0d11e7ffa56a9fb1f4990db80945fd90b6e194cb135
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: CF21C522A1CB8591EA209F25E44527A6362FFC8B94F205231EFDE837D9DF3CD640DA04

Function 00007FF600FD31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF600FE0822), ref: 00007FF600FD31E7
DeleteFileW.KERNEL32 ref: 00007FF600FD3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD32A1

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: efd949955f4c18fdf819859662d442b76fa3fff83a378b3f26a90c83dc63f370
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: 8021B622E1CB8191EA108B25E44522E7361FF84B94F605231EFDE83B99DF3CD240D600

Function 00007FF600FD32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF600FDE5B1,?,?,?,00000000,?), ref: 00007FF600FD32E7
GetFileAttributesW.KERNELBASE ref: 00007FF600FD3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD3399

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: 179fa7efefa172baa8dcfa9f71985975ef7c0d54747c194815b9a9831d008929
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: A8217162A1CB8191EA509B29E4441297361FB88BA4F604332EFDE83BE9DF3CE541C604

Function 00007FF600FFBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF600FFBF48), ref: 00007FF600FFBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF600FFBF48), ref: 00007FF600FFBF97
ExitProcess.KERNEL32 ref: 00007FF600FFBFA6

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: d59406c1d9729f133317df87425aa108fa7ede11ea388566b8dab09b62190cc2
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: B2E01A24F4870656EB546F619C95379235A6F88741F209438DD4A8339ACE3DA4098600

Function 00007FF600FCF578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCF89B

Part of subcall function 00007FF600FD3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF600FE0811), ref: 00007FF600FD3EFD

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: c851e9ba04b89524686dcd5c2666f728f32a2a2025563ce38f6b7d0a4701346e
Instruction ID: b2d08d2f5f10c4fcc5e730e02a10b089db209ba9346dd0af0708ee41dcae852c
Opcode Fuzzy Hash: c851e9ba04b89524686dcd5c2666f728f32a2a2025563ce38f6b7d0a4701346e
Instruction Fuzzy Hash: 3B918C72A1CB81A0EB10DB24D5456ADA362FB84798FA04536EE4C87BEDDF7CD589D300

Function 00007FF600FC3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC3AB9

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction ID: 6f41362f9d8f942b87fd8349d9d07abfd5c57ba830a785fc0d4546a3d236e623
Opcode Fuzzy Hash: 8a0d7ffcdee688d7cb22665fdd22367b6c642a36889c5767c2428ca75abdd5ff
Instruction Fuzzy Hash: A341EF22F1C652A4FB00DBB1D542ABC2321AF45BD8F244635DE5DA7B8EDE7CE182D200

Function 00007FF600FD2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF600FD274D), ref: 00007FF600FD28A9
GetLastError.KERNEL32(?,00007FF600FD274D), ref: 00007FF600FD28B8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: cf0eb26fcd0affed1db81c38a0853613dc0dda5172be798713d28f9e04be04de
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 0331C332F1DA5292EFA04B2AD9406792351AF24BD4F244133DE5D877E8DF3DE482B680

Function 00007FF600FC22BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF600FC22F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC23F0

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: 67dc54bc88b514017ec6e0594d6779377f7a6a93525432917bc49df900bd316e
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: B931D022A1C78192EA509B29E54577EB360FF84790F644231EF9D87B99DF7CE140D704

Function 00007FF600FD2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF600FD2AFE
SetFileTime.KERNELBASE ref: 00007FF600FD2B9B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: a77b308fc6538ef9edb6aecaecedc7903e7599e92b5598f76ba40008eb02a137
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: AA21C122F0DB4275EAA29F11D4047BA5792AF92798F354033DE4C47399EE7CD586E340

Function 00007FF600FDAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF600FDAB67
LoadStringW.USER32 ref: 00007FF600FDAB80

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: afe1770e3106c1d1301cc015d9f09356d783a1e7db2337c0db3d643467607466
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 5D118271B0874189EB008F16E840169B7A1BF89FC0FA44536DE4EE3728DF7CE9418748

Function 00007FF600FD2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF600FD2C11
GetLastError.KERNEL32 ref: 00007FF600FD2C1E

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 44f17b2b9378070127f27cf1df6ec4c32e45db54c1b64a3879231d14c77660ea
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: E2119021A1C64191EBA08B25E88126D7361FB54BB4F644333EE6D833D8CF3CE982D340

Function 00007FF600FC255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FDA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FDA504
Part of subcall function 00007FF600FDA4AC: SetDlgItemTextW.USER32 ref: 00007FF600FDA573
Part of subcall function 00007FF600FDA4AC: GetWindowRect.USER32 ref: 00007FF600FDA5AD
Part of subcall function 00007FF600FDA4AC: GetClientRect.USER32 ref: 00007FF600FDA5BB

GetDlgItem.USER32 ref: 00007FF600FC25AC
SetWindowTextW.USER32 ref: 00007FF600FC25C8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: ed907383437398bd2c9d4ffda6eb81d03170298cbd5579c5f1a76e2bcb355c71
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: D701D420E0D34A51FF8D9752A25967A1391AF86744F3C0831DC8E873DDDE2DE884D304

Function 00007FF600FDEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF600FDEBAD,?,?,?,?,00007FF600FD5752,?,?,?,00007FF600FD56DE), ref: 00007FF600FDEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF600FDEB6F

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 71bc338982b77e6bc4e4ffb245a185dbfbdc23cd6bc6d6c0ca8752d0a7d15d1c
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 72E02B61F1894646DF499F55C4504E97392BFC8B40F948037E60BC3718DE2CE1458B00

Function 00007FF600FF21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FF2200

Part of subcall function 00007FF600FF2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FF2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FF2206

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction ID: e6b3435eb0fa99441b3fde6dc72e7b93034fba20eb41083a31a05a5b4f3f3ccb
Opcode Fuzzy Hash: c507040392a2377e4895e65205c3b95c5fe2146e3485fc393c80d7c2ffdcaf26
Instruction Fuzzy Hash: C2E0EC40E9E10761F9A8626118261B401581F59370E781B30DE3E8B3CEAE1CB595F114

Function 00007FF600FFD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF600FFD922
GetLastError.KERNEL32 ref: 00007FF600FFD934

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 6ae6ce96fc42de83d4eba8418862434f49d7d7368006cd435fb6892ef9988d91
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: BDE0C260F8D10352FF19AFF298451B813D66F95B54F288034CD4EC7356EE3CA481D604

Function 00007FF600FC33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC388C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction ID: 1a1d43aca43a5da059e5f99eb48be46bb6cad182f709c26c65345055364b6597
Opcode Fuzzy Hash: af39ee99099a55e795e80951e1502b6695bf377bb292aa42fe2ae5656993095e
Instruction Fuzzy Hash: 56D1CA72B0C68265EF688B2597456B877A1FF05BC4F248835CF5D877A9CF38E560A700

Function 00007FF600FD5294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD551B

Part of subcall function 00007FF600FE13F4: CompareStringW.KERNEL32 ref: 00007FF600FE145A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction ID: ede51aea3346bcd9eb28c33fee04a163d9aa2900e1885824f2b4a80c4a732fd5
Opcode Fuzzy Hash: fa91c3799828e3c7186940546e344b2356dc381c1e63a9425ea543ecc2eeea66
Instruction Fuzzy Hash: FD61B451E0CA47A1FA64DA25942527A6293AF46FD4F344133DE4DC7BCDEE7CE481A201

Function 00007FF600FE1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FDE948: ReleaseSemaphore.KERNEL32 ref: 00007FF600FDE974
Part of subcall function 00007FF600FDE948: CloseHandle.KERNELBASE ref: 00007FF600FDE993
Part of subcall function 00007FF600FDE948: DeleteCriticalSection.KERNEL32 ref: 00007FF600FDE9AA
Part of subcall function 00007FF600FDE948: CloseHandle.KERNEL32 ref: 00007FF600FDE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE1ACB

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction ID: 433e2098bf7faa959407dc1585973a68d67bb78229a219a4ae8d79a38eeb5e18
Opcode Fuzzy Hash: f81b05313dfd5b5a73717daa6d384c08c9459244a7d30a6ec5ae517113eafb45
Instruction Fuzzy Hash: 66615F72B1A685A2EE08DB66D5540BC7369FF40F90B644236DB2D47B8ADF3CE461D300

Function 00007FF600FCEC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCEEB8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction ID: 8e551c74f46cb583878ee5ed346bfd49ff0e7aa10ff2862a4b515a9f6bedccba
Opcode Fuzzy Hash: d7b1a399856acf99fdb305a598bd345408e38bb8b7611d952776f17d246575aa
Instruction Fuzzy Hash: 7551E062A0C682A0FA14AB25E5467F92751FB85BC4F680532EF4D873DACF3DE485D300

Function 00007FF600FCE7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF600FE0811), ref: 00007FF600FD3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCE993

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: 7ca1c27ade2cbc99738022d20d430962bb791f4adaddcfe25b978dd20b3ee49c
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: A0515A22A1C686A1FB609F24D58676D7365FF84B84F640536EE8D87BA9CF3CE441D310

Function 00007FF600FD1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD187D

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction ID: 73ef2b54598e07f9ec4a48fe12044370ab203f419c13b5da774eac6d194d1757
Opcode Fuzzy Hash: 60c8fe66f84878668f1e37175277eb608c06b9d2d44befc405cc34de4c74e42f
Instruction Fuzzy Hash: BE41D762B1CA8162EB14DA17A640379A256FF44FC0F648536EE4C87F5EDF7CD5919300

Function 00007FF600FD2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD30C8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction ID: 1a458325fd6c9b1202ab3c1f5c9b55a45d3427045af670f038ee3ccd8c5d0675
Opcode Fuzzy Hash: c12ddbc590a903591de313708f19a8cb728d3d3f41945339a7b2dbf0642da7e2
Instruction Fuzzy Hash: 7441FE62A0CB0291EE509B29E54937923A2EB95BD8F240136EF4D877DDDF3DE580D640

Function 00007FF600FFBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF600FFBE20

Part of subcall function 00007FF600FFBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF600FFBFD0
Part of subcall function 00007FF600FFBFB0: GetProcAddress.KERNEL32 ref: 00007FF600FFBFE6
Part of subcall function 00007FF600FFBFB0: FreeLibrary.KERNEL32 ref: 00007FF600FFC00B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: ee9408dc8763ef988990a6ca3c04975ec0d3bce636d3057b6fbb673f984030b1
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 5E41BF22E5CA1292FB24AB11D8501B823AABF94B40F748436DE4EC77E9DF3DE845D740

Function 00007FF600FC129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC1396

Part of subcall function 00007FF600FC1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FC1F89

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction ID: e5cafe2ff2ab7534470419b885a9fed5f0956f8e7a9a8f228b0c64e015f999f6
Opcode Fuzzy Hash: c0d312b4e0c8f4018cd2918558ed466c16d78a5e43cb187cca2cc725d26fc057
Instruction Fuzzy Hash: 4321B222A0C391A5EA149F51A6016796254FF06BF4F780F30DE3D87BCADE7CE061A344

Function 00007FF60100124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601001280

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 8f350a25f42acba1ccf9e2f146c2b795ef588f638359e66c4e02eb356a963ac3
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: F0111372A1C68286E7219F90A48067972A9FF50384F650535EACEC7B96DF3CE860C748

Function 00007FF600FC3AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC3B6C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: 228b35591cab03fda474648cb5d30f7ec7ffe3641d1aa945086c9fb738076d3d
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: 5D01C462E1CB8591EA119728E4422297361FFC9794F609231EE9C47BA9DF6CE1408704

Function 00007FF600FF1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF600FF1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF600FF1573,?,?,?,00007FF600FF192A), ref: 00007FF600FF162B

DloadProtectSection.DELAYIMP ref: 00007FF600FF15C9

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: ddb7cdd331634148433e9b332c3b4000a3c23e07f7d222b26e3844c140948c27
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: D0110564E4C61791FB619F05A8803B033A4BF58348F388036CD8EC73A9EF3CA885D608

Function 00007FF600FD3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD40BC: FindFirstFileW.KERNELBASE ref: 00007FF600FD410B
Part of subcall function 00007FF600FD40BC: FindFirstFileW.KERNEL32 ref: 00007FF600FD415E
Part of subcall function 00007FF600FD40BC: GetLastError.KERNEL32 ref: 00007FF600FD41AF

FindClose.KERNELBASE(?,?,00000000,00007FF600FE0811), ref: 00007FF600FD3EFD

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 1482a9882442069aab813fb0f9da0c1f61454805f65fb1ebc426714a38a40887
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 37F0F46290C28191DB149F70A10017833619B05BB4F241336EF3D473CBCE28D444D746

Function 00007FF600FC1FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1FFB

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 23cadb91fec3bdd2c960eb1b128b5d9638ce6be25c9e1389157b11379c408e93
Instruction ID: 542430dc62243140c84b20f6d6e1d468f9658b11dd5f39b38485d366e35ac988
Opcode Fuzzy Hash: 23cadb91fec3bdd2c960eb1b128b5d9638ce6be25c9e1389157b11379c408e93
Instruction Fuzzy Hash: 43F0BEA1B1868990EE189B69C08937C2362EF45B88F600835CB4C8BB5ADF6CE490C340

Function 00007FF600FD273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF600FD2755

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: a66b5d1257024c3b4a4765aa76bc0c9ec3c6e0b438e68d56bf5d18ba0b8a6109
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: 11E0C212F24A1582EF74AF3AC8426782321FF8CF85F585032CE4D87325CE29C4818A44

Function 00007FF600FD2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF600FD24A2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 66e8f548c1a1cdd33e36bd65e457c435774b63b473fec7591b2b7256106df1c1
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: E8D01212D0D44192DE90DB35985103C2351AFA3739FB44732DE3EC27E2CE1DA496B355

Function 00007FF600FD7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF600FD7FD2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: ab5a465946bd2587a4e0dc2af5c467757dd11b43b20509574e9c1e9801ff8f36
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 06C04C21F1D602C1DB18AB26C8C911813A5BB54B05F758036D64DC6660DE2DD5EAA789

Function 00007FF600FFFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF600FFFA59

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 4e95bb9b3067767877704991bf70127b24e264a000afc1b300eb4fb066ba0fa9
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: C4F0B451F8D70765FE545B6199113B412995F84F84F3C6430CD0ECB3C9EE2CE689E210

Function 00007FF600FFD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF600FFD98A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 2b94c4d0c61d489993c70876e483601d154433800dc8219767cb152f513c6a77
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 2AF08C50F8D20764FF246BF158002B4229A5F847A4F285A30DD6EC73C9DEACA480E211

Function 00007FF600FD20D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF600FD207E), ref: 00007FF600FD20F6

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 9503d0ca1c187937fa3395a638fe9fb2990126971681c4d0b00ac4db2ecdd9ab
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 5CF0CD21A0C64255FB648F30D1413792761EB14B79F688336EF7D822DCCF28D895D740

Non-executed Functions

Function 00007FF600FCC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FCDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF600FCCF4B), ref: 00007FF600FCDE27
Part of subcall function 00007FF600FCDE04: GetLastError.KERNEL32 ref: 00007FF600FCDE88
Part of subcall function 00007FF600FCDE04: CloseHandle.KERNEL32 ref: 00007FF600FCDE9B

wcscpy.LIBCMT ref: 00007FF600FCCBC8
wcscpy.LIBCMT ref: 00007FF600FCCBFE
CreateFileW.KERNEL32 ref: 00007FF600FCCC38
DeviceIoControl.KERNEL32 ref: 00007FF600FCCD01
CloseHandle.KERNEL32 ref: 00007FF600FCCD12
GetLastError.KERNEL32 ref: 00007FF600FCCD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF600FCCD7D
DeleteFileW.KERNEL32 ref: 00007FF600FCCD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCCED7

Strings

\??\, xrefs: 00007FF600FCC392, 00007FF600FCC3B8
SeRestorePrivilege, xrefs: 00007FF600FCC343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF600FCC34F
UNC\, xrefs: 00007FF600FCC53F, 00007FF600FCC55D

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction ID: 4788d4256893741de8b32d905d875900d85d70d312cd2adef36194e90e1a1e08
Opcode Fuzzy Hash: 133043678a36d966ba880c912d6856c5696a7c6c433e50d223eb52f27bd95b56
Instruction Fuzzy Hash: C062BB62F0C682A5FB00DB74D5466BD2361AF857A4F204632DE6D93BEADF38E185D340

Function 00007FF600FDF180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF600FE0528

Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB67
Part of subcall function 00007FF600FDAAE0: LoadStringW.USER32 ref: 00007FF600FDAB80

Part of subcall function 00007FF600FEB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF600FE0429), ref: 00007FF600FEB110
Part of subcall function 00007FF600FEB0DC: SetLastError.KERNEL32 ref: 00007FF600FEB153

Part of subcall function 00007FF600FC129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE0538

Strings

%ls, xrefs: 00007FF600FDF3AC, 00007FF600FDF3FF
%s: %s, xrefs: 00007FF600FDFC11

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction ID: 61a27be70f3b63be4e1a5b083897defda9a458513c0ba9eafabe0be4172e2430
Opcode Fuzzy Hash: 945c123c5738f6103966ecffbffa27c83b3bf35cf43ea0aac1725ee40d95c140
Instruction Fuzzy Hash: DFB29962A5C68291EA10AB25E5551BEA311FFC67D0F204336EF9D837EEEE6CE540D304

Function 00007FF601002550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601002C12
memcpy_s.LIBCMT ref: 00007FF6010035BF
memcpy_s.LIBCMT ref: 00007FF601003666

Part of subcall function 00007FF6010038BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6010038EE

memcpy_s.LIBCMT ref: 00007FF60100372F

Part of subcall function 00007FF600FFD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFD02D

Strings

1#IND, xrefs: 00007FF6010037AA
1#INF, xrefs: 00007FF601003807
1#SNAN, xrefs: 00007FF6010037C9
1#QNAN, xrefs: 00007FF6010037E8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: bd9dab2f537336351e1179701cd91330717b5e1f58af5d496a21e90f689cfd05
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: BDB2F572A082828FE7678E69D4447FD37A5FB84788F605135DA4B9BB88DF38E544CB04

Function 00007FF600FD1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF600FD1A97
GetLongPathNameW.KERNEL32 ref: 00007FF600FD1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF600FD1B21
GetShortPathNameW.KERNEL32 ref: 00007FF600FD1B6A

Part of subcall function 00007FF600FE13C4: CompareStringW.KERNEL32 ref: 00007FF600FE13E3

MoveFileW.KERNEL32 ref: 00007FF600FD1DFE
MoveFileW.KERNEL32 ref: 00007FF600FD1E65

Part of subcall function 00007FF600FD2134: CreateFileW.KERNEL32 ref: 00007FF600FD223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD1FED

Strings

rtmp, xrefs: 00007FF600FD1CF4, 00007FF600FD1D03

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction ID: bc8e45892bea12b2f4706e370852c68459591acf58dc3bb9e95a7f81c98b4f07
Opcode Fuzzy Hash: 3dcc5890c2e22e4a5feb2ae31f1f4ae3f3b67a4ee4a7a529d594af89e49fc87b
Instruction Fuzzy Hash: 95F1AE22B1CA82A1EB10DB65D4801FE6762FB85784F601536EE4D87BADDF3CE584D740

Function 00007FF600FD5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF600FD5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF600FD5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF600FD5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF600FD5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD5EF2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: 7b85e7bd4c03589cfdd3abb5609b6c4e65273030222dc9c81cfbd96262385338
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: 76A1A262F28B5194FF109BB998445BC2362AF85FE4B244236DE6D97BCDDE7CE081D204

Function 00007FF600FF3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF600FF318C
RtlCaptureContext.KERNEL32 ref: 00007FF600FF31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF600FF31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF600FF3214
IsDebuggerPresent.KERNEL32 ref: 00007FF600FF3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF600FF3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF600FF3294

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 0e00705124af4a9a2a2551f79dde006ea8d8315ff010e27bb444c0e6a5423c2b
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 6D315272A09B819AEB649F60E8503FD7364FB84744F54843ADA8E87B98DF38D648C714

Function 00007FF600FF76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF600FF7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF600FF7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF600FF77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF600FF77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF600FF77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF600FF77F2

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 8f050d228de1c91f2e0dd5457a5aee0387949395c49ee350abe8d125fc76856f
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 89316132A18B8195EB649F25E8402BE73A4FB88754F644136EE8D83B99DF3CD545CB00

Function 00007FF600FC1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FC1EBB

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction ID: f8026b2dba7afc62846500ceca115c231a43274b0bffc342fa9364150d9e7b44
Opcode Fuzzy Hash: c264b490cac148f64dd39c131735208f64494c1dc21ecf378d5d3bcbd534f5da
Instruction Fuzzy Hash: 71B1D022B18B86A5EB10AB65D9416FD2361FF8A794F605631EE4D83B9EDF3CE540D300

Function 00007FF600FFFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFFAC4

Part of subcall function 00007FF600FF7934: GetCurrentProcess.KERNEL32(00007FF601000CCD), ref: 00007FF600FF7961

Strings

*?, xrefs: 00007FF600FFFAEB
., xrefs: 00007FF600FFFEE4

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 64e9186eaf107e7ac79716fdcad661876862a7385c3383c9219bcbca186c721f
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: E351F362B58B9A51EB10DFA2D8100BC63A8FF88BD8B644531DE1D97B88EE3CD046D300

Function 00007FF601002080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF60100210B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: c5728f3428ce8cef2ff4d0b6fea16b0de472b14e28d06a7b1ee473151062cbdf
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 88D1B432B1868687DB35CF15E1886AAB7A1F798784F248134DB8F97B44DE3DE941CB04

Function 00007FF600FCB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF600FCBA9D), ref: 00007FF600FCB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF600FCBA9D), ref: 00007FF600FCB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF600FCBA9D), ref: 00007FF600FCB743

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: 9a120fd9f871353eb678ad2ab117dc6944b481af6de4571aeeb20288c0a3a54e
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 94011275A0C74292EB509F22B95167AA395FF89BC0F588035EE8E87B49CF3CD5059F04

Function 00007FF600FFFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF600FFFEE4

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 4b1734936a11705d9bb5a6a66d94ab406e984eb1b5261e459c08b3130c64117e
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 93312B22B0C69555F7209F36A8047B9BA95BF94BE4F248235DE6C87BDACE3CD505C300

Function 00007FF601005AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF601005D45
RaiseException.KERNEL32 ref: 00007FF601005D56

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 553e8fb3406d8d5858300733fc238b28823c924b418b0bfbb95dbb8064938f13
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: E0B15F73604B898BEB16CF29C84636C7BA0F744B48F258926DB9E877A4CF39D451CB04

Function 00007FF600FE8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FE85E0: GetDC.USER32 ref: 00007FF600FE85EC
Part of subcall function 00007FF600FE85E0: GetDeviceCaps.GDI32 ref: 00007FF600FE85FD
Part of subcall function 00007FF600FE85E0: ReleaseDC.USER32 ref: 00007FF600FE860A

GetObjectW.GDI32 ref: 00007FF600FE8E48

Part of subcall function 00007FF600FE90B0: GetDC.USER32 ref: 00007FF600FE90D9
Part of subcall function 00007FF600FE90B0: GetObjectW.GDI32 ref: 00007FF600FE9107
Part of subcall function 00007FF600FE90B0: ReleaseDC.USER32 ref: 00007FF600FE91BB

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: aa20128147502ab71fcee9219e2cdf09be3b5ab675a71fb21bb29b5ee29772b5
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 2A814B36B08A4586EB20DFAAD8446AC3771FB88B88F204132DE4E97B28DF3DD545C744

Function 00007FF600FEA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF600FEA315
GetNumberFormatW.KERNEL32 ref: 00007FF600FEA371

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: fb17250e66c9ccce7b4f8fd03b990d894d57075885ad245355eaa52d9e2546c7
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 3E117F32A08B8195E7619F11E4103E97370FF88B48F944135DA8E83768EF3CE545C749

Function 00007FF600FD126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD24C0: CreateFileW.KERNELBASE ref: 00007FF600FD259B
Part of subcall function 00007FF600FD24C0: GetLastError.KERNEL32 ref: 00007FF600FD25AE
Part of subcall function 00007FF600FD24C0: CreateFileW.KERNEL32 ref: 00007FF600FD260E
Part of subcall function 00007FF600FD24C0: GetLastError.KERNEL32 ref: 00007FF600FD2617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD15D0

Part of subcall function 00007FF600FD3980: MoveFileW.KERNEL32 ref: 00007FF600FD39BD
Part of subcall function 00007FF600FD3980: MoveFileW.KERNEL32 ref: 00007FF600FD3A34

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction ID: 3202e89e77fb8a4a1eb7b09a7cee23197e1a7281b30f3326ad630d7a4e2697df
Opcode Fuzzy Hash: 980cd56be866766a23a9553c8d4159ccf1d73d98ddfd7d5c2418f08c88695bde
Instruction Fuzzy Hash: 1D91D022B1C642A2EB50DB66E4446AE6362FF95BC4F644033EE0D87B99DF3CD545E340

Function 00007FF600FD51A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF600FD51D5

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: db8020e57bb0889a7e4512e9926ac62194e3b6ebe28cbcff989e8695c4fb30fb
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: 4A01ED71E0C64287F764CB10E85577533A2BB98714F600235E59EC7798DF3CE5059E04

Function 00007FF600FF8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF600FF8DD3

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: d5261abbfade2703c2c86cdf994dbd414cd0cbd36f65466cd91fdb26ce91f67b
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: C481F322A5C24266EBA88A25808067D23A8EF517C8F741531DD09DBBDDCF3DE847E740

Function 00007FF600FF89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF600FF8B3A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: e63517a6416faf2aae93de6d4ee5d566255de4820833e2837543e455bb35021a
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 81710621A8C28276FB688A29504027D6798DF81BC4F381536DE09CB7DECE6DE847F741

Function 00007FF600FDC96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF600FDC97B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: b15ab5945611315982af307c0b727d2fdb8361a7e7457a0fc333d24a7ae667cf
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 4551A0377286909BD724CF25E400A9AB3A5F388758F145126EF8A93B09CF3DE945CF40

Function 00007FF600FFC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF600FFC874

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: cd01aabd44bbb497af37f88dd148a53135531447fbe26162b89cf840695552f0
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: E341DE22718B5886EF08CF2AE5142A973A5BB48FD4B69A036DE4EC7758DE7CD442D340

Function 00007FF601000D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF601000D24

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 6f6d8495a52ce9ba652da6bae11c8311f7c330550b2f68171fc42eb5e1b4d45a
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 9CB09220E17A02C2EB092F116C8225423A4BF88700FA4C039C18E81320DE2C25A54704

Function 00007FF600FE3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction ID: e2de345b66c8179d1f29882763d872de79c5dd3f2cb53ab274d7123780e05e67
Opcode Fuzzy Hash: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction Fuzzy Hash: A28216A7A0D6C196D715CF28D4082BC7BA1E755F88F29813ADE8E87389EE3CE545D310

Function 00007FF600FC76C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 6a1e0187d56d70c48a535d4a257eb9641cb5a081bc8a79362616d40f59e49f50
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: CE627D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF600FE53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction ID: a1b035bfd4a6a774c069d178e1edf742f0f9cdaed33188cf28bfefc63b72eb5e
Opcode Fuzzy Hash: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction Fuzzy Hash: 93820FB2A0DAC19AD724CF28D4146FC7BA1E755F48F288236CE4D87789EE3C9885D710

Function 00007FF600FDBB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 86b7ec8704429e93a4c3d10bc260f2d6fdb5996169c725e51aed67ff383ad444
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 8D22E5B3B246508BD728CF15C89AE5E3766F798744B4B8229DF0ACB789DB38D505CB40

Function 00007FF600FE4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: b92d9ad43643a20632713c0f81ea46253e06a72fd8292c16744b0032a03a1cb5
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 9232AF72A085D19BE718CF28D550ABC37A1F754B48F25813ADE4A87B88EF3CE855DB40

Function 00007FF600FC7288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 3cc08b15f6f2058cd28a0e06da5645cf310eae4d31a78f68a0db26d5dc20fb20
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 14C19DB7B281908FE350CF7AE400AAD3BB1F39878CB519125DF59A7B09D639E645CB40

Function 00007FF600FE2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 53f552667e317df96fe25cb7ed072eea92fc6e76c377a166ed855d70d0ca4f42
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: DDA13373A0C1C2A6EB65CA28D4487FD2796EB90748F654535DE4E8778AFE3CE941E300

Function 00007FF600FDAF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: f1b669c5b98c683d9adae51301452a19088b78d2bd88c7c3f136bccefb15a1c1
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: C0C10573A291E04DE302CBB5A4248FD3FF2E71E34DB4A4152EF9667B4EC6285201DB60

Function 00007FF600FCA310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 59fbb532f594ed2c04fac47a783375fc6a6493061933718d7e7371f2ca6cde83
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 01911D62B1C685A6EB11CF29D4516FD2721FF95788F540032EF4E87B59EE39E606C300

Function 00007FF600FDB534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 08c2a75ec3cce77aae08ce147429cb1ba5710fa470662bf46dc210e3b212c26f
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 5F610123B181D5A9EB01CF7585004FD7BB2AB49784B5A8073CE9A9774ACF3CE506EB10

Function 00007FF600FE21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 81e46c2f9864c9f91191495ff08189ae9abcb3e8f08544f4b46065c8f3439035
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: B6510E73A181916BE7688F28A404BBD3766FB80B48F654134DF4987788EE3DE941EB00

Function 00007FF600FE2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: c6d448996da8dba389cf750df7f38b97f9cd1f002b4599dbec621491daa204ef
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: EA31E3B2A0C5815BE758CE1AD95127E7791F784740F148139DF4AC7B45EE3CE041DB00

Function 00007FF6010058E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: abf7436659d2ade255e930725288d5bfba6412fdcb7cd4cbeab3888330c6a00d
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: 83F03C717186658BDBA5CF2DA84262977D0F7483C4F548079D5CDC3B14DE3C94519F08

Function 00007FF600FF3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 0e9c51f5c6dce7a28f49803a7ec10160f1158fbf8b6c999f93604e383ede7282
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 34A0016194CC42E0E6498B10A8600712324BB90300B608032E54EC21A8DF2CA501D204

Function 00007FF600FCD7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD964

Strings

::$INDEX_ALLOCATION, xrefs: 00007FF600FCD83E
::$FILE_NAME, xrefs: 00007FF600FCD833
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF600FCD875
::$INDEX_ROOT, xrefs: 00007FF600FCD854
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF600FCD85F
::$BITMAP, xrefs: 00007FF600FCD807
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF600FCD86A
::$DATA, xrefs: 00007FF600FCD812
::$OBJECT_ID, xrefs: 00007FF600FCD880
::$REPARSE_POINT, xrefs: 00007FF600FCD88B
::$ATTRIBUTE_LIST, xrefs: 00007FF600FCD7FC
::$EA, xrefs: 00007FF600FCD81D
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF600FCD849
::$EA_INFORMATION, xrefs: 00007FF600FCD828

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction ID: da363b8bfb4255240ad745781dd3156ae54e1d6d9a397d2020da8432a9662c6d
Opcode Fuzzy Hash: 036f0b4177b3bd4acf8be137eac01bdc749329f6e627dd372102b0288b9b6631
Instruction Fuzzy Hash: 2C41E336A09F05A9EB019F60E4813ED33B9FB48798F604636DE8D83B69EE38D155C344

Function 00007FF600FF2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF600FF2A26
GetModuleHandleW.KERNEL32 ref: 00007FF600FF2A33
GetModuleHandleW.KERNEL32 ref: 00007FF600FF2A48
GetProcAddress.KERNEL32 ref: 00007FF600FF2A60
GetProcAddress.KERNEL32 ref: 00007FF600FF2A73
CreateEventW.KERNEL32 ref: 00007FF600FF2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF600FF2AEB
CloseHandle.KERNEL32 ref: 00007FF600FF2AFD

Strings

WakeAllConditionVariable, xrefs: 00007FF600FF2A66
SleepConditionVariableCS, xrefs: 00007FF600FF2A56
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF600FF2A2C
kernel32.dll, xrefs: 00007FF600FF2A41

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: 39b6601306857e38e39ae70667574cd99fce1bffd0381f5c2576c76e9c4ca2b5
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 1A21E764E5DA0391EF969F51E85517423A8AF48B80FB48036DD8FC37A4EE3CA545D304

Function 00007FF600FD6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70A6

Part of subcall function 00007FF600FC2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF600FC200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD70DC

Strings

DXGIDebug.dll, xrefs: 00007FF600FD6A18
UNC, xrefs: 00007FF600FD6BBF
\\?\, xrefs: 00007FF600FD6A57, 00007FF600FD6A66

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction ID: 1844dfd51021b0c0ce0ab2f2b217ca75d20b16703bac92ba019a28fbcf1e4927
Opcode Fuzzy Hash: 56c6116d5534ddc5b4079fdeed8715d081fed04d0e9eb28ce3c332ce1ff1d7ed
Instruction Fuzzy Hash: C312AD22B0CB42A0EB10DB69D4441AD6372EB85B88F604236DE5D87BEDDF3CE549D344

Function 00007FF600FEA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FC129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF600FC1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FEA747
EndDialog.USER32 ref: 00007FF600FEA7BA

Strings

GETPASSWORD1, xrefs: 00007FF600FEA773
Software\WinRAR SFX, xrefs: 00007FF600FEA52B, 00007FF600FEA53A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: df67387c519d23a8ee83acb6dd55ee7a56b3d6602c701a9de240f88d6006b232
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: 31B1AB62F1DB8295FB00DB64D4442BC2362AF85398F604236DE5DA7BDDEE3CE445D204

Function 00007FF600FE6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF600FE7E9B), ref: 00007FF600FE7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF600FE70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE7187

Strings

</html>, xrefs: 00007FF600FE6F72, 00007FF600FE6F81
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF600FE6F2C, 00007FF600FE6F3B
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF600FE6ED5, 00007FF600FE6EE4
<html>, xrefs: 00007FF600FE6F13

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction ID: 5486da73e30b6ea9fe3c7a167268feaa5f997ef363cf9f3a885d831ef2d7a445
Opcode Fuzzy Hash: 31d7dc5894d1c9fa85229d9e77b41a308ef747ae09a8312bf4b27f03762016a6
Instruction Fuzzy Hash: 03818C62B1CB86A5FB01EBA5D4402FD6371AF48788F604536CE1D9779AEE38E50AD304

Function 00007FF600FFE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFE7CD

Strings

NAN(IND), xrefs: 00007FF600FFE6FB
NAN, xrefs: 00007FF600FFE6B1
INF, xrefs: 00007FF600FFE6C3
inf, xrefs: 00007FF600FFE6D6
nan(ind), xrefs: 00007FF600FFE706
NAN(SNAN), xrefs: 00007FF600FFE6E5
nan(snan), xrefs: 00007FF600FFE6F0
nan, xrefs: 00007FF600FFE6B8

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: c9f0bd9178a4f3e22c65b0617da5d34f1390eb6dea38c1b30926adcef33e7c33
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: C241AE72A0AB4599F715CF25E8417AD33A8EB18398F214236EE9D87B98DE3CD125C344

Function 00007FF600FEF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF600FEF3CF
GetClassNameW.USER32 ref: 00007FF600FEF3FC
GetWindowLongPtrW.USER32 ref: 00007FF600FEF41D
SendMessageW.USER32 ref: 00007FF600FEF437
GetObjectW.GDI32 ref: 00007FF600FEF452
SendMessageW.USER32 ref: 00007FF600FEF487
DeleteObject.GDI32 ref: 00007FF600FEF490
GetWindow.USER32 ref: 00007FF600FEF49E

Strings

STATIC, xrefs: 00007FF600FEF402

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: b00b410c22894e309e48836107e8d4838895d41e8c05c730aaf0af1e08107be6
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: 6C317425B0C78296FB60DB12E5547BA6391BF89BD0F644430DD4E87B99EF3CD8468740

Function 00007FF600FEAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF600FEAEAE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 0a29863c05743b90dbf15ab5d8b5df70c8121804ce87226765cea7a0e95a2490
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: F941B135B0CA9282FB549B12E81477923A1AF88F84F744435DD4F87B99DF3CE9469309

Function 00007FF600FDB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF600FDBA12
GetProcAddress.KERNEL32 ref: 00007FF600FDBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF600FDBACA

Part of subcall function 00007FF600FDDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF600FDDDDF

Strings

Crypt32.dll, xrefs: 00007FF600FDB9F0
CryptProtectMemory failed, xrefs: 00007FF600FDBA80
CryptUnprotectMemory failed, xrefs: 00007FF600FDBAC1
CryptProtectMemory, xrefs: 00007FF600FDBA08
CryptUnprotectMemory, xrefs: 00007FF600FDBA1F

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: cea1e034c34b2595d4425d3cb1d2f24c37b8aca58fecf8a3ed5f0e37f8d92671
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 4E316824F0DB0290FB169F12A95527533A2BF59B90F264136CD8F833A9DF3CE941A308

Function 00007FF600FE87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FE8DE0

Strings

, xrefs: 00007FF600FE8A55
, xrefs: 00007FF600FE88BE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction ID: e1954ad749b992f68f47a4d55469ad3e58be06f854788afb9b679e8c6001b597
Opcode Fuzzy Hash: 7957b1f7c23d8b99e8b957fd2374c8a83d1170bc9397b993806739df2f8497c6
Instruction Fuzzy Hash: 9FF1DF62F1DB86A0EE10AB69D4441BC2362AB45BD8F605631CE6D937DDEF7CE182D340

Function 00007FF600FF57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF600FF598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF600FF5CAD
abort.LIBCMT ref: 00007FF600FF5CE1

Strings

csm, xrefs: 00007FF600FF5933
csm, xrefs: 00007FF600FF58D1
csm, xrefs: 00007FF600FF59B1

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: c71dd4e532625c8271f4a1217f1b76db58bd881182c919e10764a58840905287
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 74E18D7294CB829AE7209B65D4802BD7BA8FF45B58F240235DF8D9779ACF38E485D700

Function 00007FF600FD4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD4E24: SysAllocString.OLEAUT32 ref: 00007FF600FD4E5F

VariantClear.OLEAUT32 ref: 00007FF600FD5125

Strings

Windows 10, xrefs: 00007FF600FD510A
Name, xrefs: 00007FF600FD50F9
ROOT\CIMV2, xrefs: 00007FF600FD4F7B
WQL, xrefs: 00007FF600FD502A
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF600FD5017

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 14dc9d28fb434b29dc29e9dac34a760e873db62593d09c700f3b919b783d7495
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 87711B76A18A0595EB20CF25E8806AD77B5FB88B98F645137EE4E83B68CF3DD544C700

Function 00007FF600FF72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF600FF74F3,?,?,?,00007FF600FF525E,?,?,?,00007FF600FF5219), ref: 00007FF600FF7371
GetLastError.KERNEL32(?,?,00000000,00007FF600FF74F3,?,?,?,00007FF600FF525E,?,?,?,00007FF600FF5219), ref: 00007FF600FF737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF600FF74F3,?,?,?,00007FF600FF525E,?,?,?,00007FF600FF5219), ref: 00007FF600FF73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF600FF74F3,?,?,?,00007FF600FF525E,?,?,?,00007FF600FF5219), ref: 00007FF600FF73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF600FF74F3,?,?,?,00007FF600FF525E,?,?,?,00007FF600FF5219), ref: 00007FF600FF73FB

Strings

api-ms-, xrefs: 00007FF600FF7391

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: 840f2a9f1902b6dcbfa6f2c004993251438e3308614eb06b4ceac8a95c0ef28f
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 4A31C321A5EB42E1EF12EB16A8006756398FF08BA4F2A4935DD5D8B398DF3CE441E710

Function 00007FF600FF1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF600FF1573,?,?,?,00007FF600FF192A), ref: 00007FF600FF162B
GetProcAddress.KERNEL32(?,?,?,00007FF600FF1573,?,?,?,00007FF600FF192A), ref: 00007FF600FF1648
GetProcAddress.KERNEL32(?,?,?,00007FF600FF1573,?,?,?,00007FF600FF192A), ref: 00007FF600FF1664

Strings

KERNEL32.DLL, xrefs: 00007FF600FF1624
ReleaseSRWLockExclusive, xrefs: 00007FF600FF1653
AcquireSRWLockExclusive, xrefs: 00007FF600FF163E

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 20972c99faae5d4a4f981806093a1081c17a6284b8deb3cd9552ed477cd1843e
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 28111B24E5EB02E1FF658F01A94027422997F08794FBC9436CD5EC7398EE3CA884E604

Function 00007FF600FDED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD51A4: GetVersionExW.KERNEL32 ref: 00007FF600FD51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF600FC5AB4), ref: 00007FF600FDEE05

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 0ac72a922d000cec713124989e096cc05328dd76c127b843e630dc1f0eeb0a74
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 94516BB2F146519AEB14CFA9D4441AC77B2FB48B88B60803ADE4E97B58DF38E556C700

Function 00007FF600FDF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF600FDF074

Part of subcall function 00007FF600FD51A4: GetVersionExW.KERNEL32 ref: 00007FF600FD51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF600FDF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF600FDF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF600FDF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF600FDF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF600FDF0CE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 1f72a2bb3fe56e814a07f13e92d3fbbc859b6a69c74f6b54c5b6226b2b263978
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: CC312662F14A519AEB00CFB5E8801AC3771FB18758B64503AEE4EA7A58EF38D895C704

Function 00007FF600FD7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD7C8C

Strings

sfx, xrefs: 00007FF600FD79F3, 00007FF600FD7A02
exe, xrefs: 00007FF600FD79AF, 00007FF600FD79BE
.rar, xrefs: 00007FF600FD7969, 00007FF600FD7978
rar, xrefs: 00007FF600FD7A9B, 00007FF600FD7AAA, 00007FF600FD7B67, 00007FF600FD7B7C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction ID: 5d8a3795b73e1b74a3214e7fe3020a8c9ad59be84c58e48debbba02483de6593
Opcode Fuzzy Hash: 2fc35cbdd70ebaba8229e08f8487c40f3259a53efddd90ef8447a9b59f22dcea
Instruction Fuzzy Hash: 83A18D22A1CB0660EB04AF25D4452BC2362BF41B98F605236DE5E8B7AEEF3CE545D340

Function 00007FF600FF5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF600FF5D58

Part of subcall function 00007FF600FF5210: abort.LIBCMT ref: 00007FF600FF5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF600FF5DA3
abort.LIBCMT ref: 00007FF600FF5FD1

Strings

RCC, xrefs: 00007FF600FF5D74
MOC, xrefs: 00007FF600FF5D6C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: ad63315f9fdce73075846133519097fc33ed5dc58e54d54354d41248eb690098
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: C1919073A08B91AAE710CB65E4402AD7BA4FB44B88F244139EF8D97B59DF38D195DB00

Function 00007FF600FF4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF600FF4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF600FF5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF600FF2F5E), ref: 00007FF600FF508F

Strings

f, xrefs: 00007FF600FF4FBE
csm, xrefs: 00007FF600FF5026

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 1981610e42d09f9afabae5849b54afde4493190b91482ad445894ae370744a99
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 73518C32A5DA02A6EB14DF15E844A3937A9FF44F88F618134EE5A8778CDF78E841D740

Function 00007FF600FCCEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF600FCD03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD0D7

Part of subcall function 00007FF600FCDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF600FCCF4B), ref: 00007FF600FCDE27
Part of subcall function 00007FF600FCDE04: GetLastError.KERNEL32 ref: 00007FF600FCDE88
Part of subcall function 00007FF600FCDE04: CloseHandle.KERNEL32 ref: 00007FF600FCDE9B

Strings

SeSecurityPrivilege, xrefs: 00007FF600FCCF3F
SeRestorePrivilege, xrefs: 00007FF600FCCF5E

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction ID: 5251f7cc3b5be4603e597bd4040cea896505a46993199bc6daef20c5b132f52c
Opcode Fuzzy Hash: 6c1d5a5d5395298d9d74f6f4ee4569930d238c95dd33962f37e3fdaa32d53d1a
Instruction Fuzzy Hash: C851E162F0C742A5FB10EB64D9426BD23A1AF847A4F200535DE5E9379EDF3CA886D200

Function 00007FF600FE7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF600FE7B6F
GetWindowRect.USER32 ref: 00007FF600FE7BC0
ShowWindow.USER32 ref: 00007FF600FE7C96
ShowWindow.USER32 ref: 00007FF600FE7CC3

Strings

RarHtmlClassName, xrefs: 00007FF600FE7C4B

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: 0fe29a172181e35d2bfec199b86baa1059c0a81fa1206aa9e38b293f7112c53c
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: A0517222A0DB829AEB64AB25E44437AB3A0FF85780F244435DE8F87B59DF3CE4458700

Function 00007FF600FEFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF600FEFF60
REPLACEFILEDLG, xrefs: 00007FF600FEFF34, 00007FF600FEFF99

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: d4fa762af8a6d0b2ec491b99b3d29c5716eb3f16daf52427862d94143510c0ea
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: 3921E922A0CB8791FB118F15E84417477A0AB4AB88F744136D98EC7368EE3CE9899348

Function 00007FF600FFBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF600FFBFD0
GetProcAddress.KERNEL32 ref: 00007FF600FFBFE6
FreeLibrary.KERNEL32 ref: 00007FF600FFC00B

Strings

CorExitProcess, xrefs: 00007FF600FFBFDF
mscoree.dll, xrefs: 00007FF600FFBFC7

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: 4b3a03c85c21983b6c98b45d022cfaf711d3a071ca583be033db73bc73c30449
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: D2F04921A19A4291EF568F11E98027963A4FF88B90F69503AE98FC7769DE3CE485C704

Function 00007FF6010045C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601004605

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 6c784ce944b4a98f8f3776753bd21e8eda7825184e7ac54354dee73474fe606c
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 8F81ED22F1860289FB229F6588406BD26A5BF55B88F608136DF8FD3B95DF3CA445C70C

Function 00007FF600FD3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF600FD3BBB
CreateFileW.KERNEL32 ref: 00007FF600FD3C24
SetFileTime.KERNEL32 ref: 00007FF600FD3CEC
CloseHandle.KERNEL32 ref: 00007FF600FD3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD3D2C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction ID: a9dd075c383b1076779c7c23477bae74c8e301c73e53c990661d46484ba0ac88
Opcode Fuzzy Hash: 14fdea18fdcf977c61dce6ecaccc8aa35300d093acc7d7c713630260d7cb0aba
Instruction Fuzzy Hash: 1A51DF22F18A02A9FB50DF65E8403BD23B2AB847A8F244636DE5D977D8DE389205D301

Function 00007FF601003F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF601004767), ref: 00007FF601003F91
WideCharToMultiByte.KERNEL32 ref: 00007FF60100406D
WriteFile.KERNEL32 ref: 00007FF601004093
WriteFile.KERNEL32 ref: 00007FF6010040D2
GetLastError.KERNEL32 ref: 00007FF60100410A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 70082f6473a4984671a3d2a874f75ea107df3dfadbb4ba807e0dfcccaebe27c5
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 7A519E32B18A5189E711CF65D4443AC3BB5BB54B98F248136DF8A97BA8DF38D145C708

Function 00007FF600FF1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF600FD4DF4), ref: 00007FF600FF1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF600FD4DF4), ref: 00007FF600FF1F09
SysAllocString.OLEAUT32 ref: 00007FF600FF1F16

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction ID: 5fb5464594f1cd614920a189f2b87e207fdfa9b6d7c10ea06474b1947c7f4dc5
Opcode Fuzzy Hash: 55eea0222137253c860f73f771396d48486a61dcff80d6f5aaddb46a2ec13fc8
Instruction Fuzzy Hash: 1141F331A4DA46DAEB549F2194403B82298FF08BA4F244635EE6EC77D9DF3CE041D300

Function 00007FF600FFF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF600FFF536

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 2c15b0343d04eec2e0b0d25b1f22aecc52cc7c408450f55f26261213d094011e
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: CE41B062B0DA42A1FB168F12A8006756299BF14BE0F2D4536DE5ECB79CEF3CE448D344

Function 00007FF6010056D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6010056FF
_set_statfp.LIBCMT ref: 00007FF60100571A
_set_statfp.LIBCMT ref: 00007FF601005736
_set_statfp.LIBCMT ref: 00007FF601005772

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 8af148f6362747b2a84f5c5738b472bdb1e40f81e868b65284c3fb73eacf89f5
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: B611C136E1CA4781F76A0924FD4637905417F483A0F788230EAFF8A6D6DE2CA8416A0D

Function 00007FF600FEFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF600FEFE41
GetMessageW.USER32 ref: 00007FF600FEFE58
TranslateMessage.USER32 ref: 00007FF600FEFE63
DispatchMessageW.USER32 ref: 00007FF600FEFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF600FEFE7C

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 3664e0130c8c0752f603d053165da36ce0207365bd2217f04c242aa1450a7ce9
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: CAF01231F3854692F7509B20E855B762251FFE4B05FB45030E98FC29A4DE3CE549D704

Function 00007FF600FF625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF600FF6286
abort.LIBCMT ref: 00007FF600FF64EA

Strings

csm, xrefs: 00007FF600FF641A
csm, xrefs: 00007FF600FF62AB

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: ec5d4d70a1bdb1b79772025493205dc450c51b9a76a74f88655ed7aea17ea661
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 8F718E72A4C6919ADB609F259050779BBA4FF05B89F248136EE4CC7B89CF2CE491E740

Function 00007FF600FF80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FF811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FF82ED

Strings

, xrefs: 00007FF600FF8276
*, xrefs: 00007FF600FF8221

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 79d790fd99d4772a40a9e962b0c4650a233fae45834c7410514a370dfb0225ee
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 3051357298C6429AE7658E28844537C3BA9EF05B99F341235CE4AC339DCF68E483E605

Function 00007FF601001758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6010017CB
MultiByteToWideChar.KERNEL32 ref: 00007FF601001894
GetStringTypeW.KERNEL32 ref: 00007FF6010018AE

Strings

$%s, xrefs: 00007FF60100175A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 46f2f157cd086f40a0ae1e9b046c39fd862e6ff4a5c28b8efc3ab8b09f7f8450
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 49419532B18B819AEB618F25D8402B963A5FF44BA8F684235DE5E877C5DF3CE6418304

Function 00007FF600FF66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FF5210: abort.LIBCMT ref: 00007FF600FF5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF600FF674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF600FF6776

Strings

csm, xrefs: 00007FF600FF6876

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: a93342e3171349c1341b30e492dcb0a2e8287e91f6aaa6588cd9ecf78b495f1f
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 6E514D7265DB41A7DA20AB16E44027E77A8FF89B90F240634EF8D87B59CF38E451DB00

Function 00007FF601004360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF601004446
WriteFile.KERNEL32 ref: 00007FF601004479
GetLastError.KERNEL32 ref: 00007FF60100449B

Strings

U, xrefs: 00007FF601004424

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 3abf411654886b2dcfea7ae7b4dbf91728c782b7db3cefb414cc38b4cb6f90a0
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 7441B222A18A8182EB61CF25E8443BA77A0FB88794F558131EF8EC7788DF7CD441C748

Function 00007FF600FE90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF600FE90D9
GetObjectW.GDI32 ref: 00007FF600FE9107
ReleaseDC.USER32 ref: 00007FF600FE91BB

Strings

, xrefs: 00007FF600FE9153

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: e752da18a024f730b13d0599346045cefe7bfa98593901846159ebc072992811
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 50314F3560874186EB14DF12F858A2AB760F789FD1F605435ED8B83B54CE3CD889CB04

Function 00007FF600FDE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF600FE317F,?,?,00001000,00007FF600FCE51D), ref: 00007FF600FDE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF600FE317F,?,?,00001000,00007FF600FCE51D), ref: 00007FF600FDE8CB
CreateEventW.KERNEL32(?,?,?,00007FF600FE317F,?,?,00001000,00007FF600FCE51D), ref: 00007FF600FDE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF600FDE900

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 4ebe3d569dd8182705442487115345c19329f4f44540d355ee566316d1a0d3b5
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 3521D232E1960186F7109F24E4557AD32A2FF88B0CF288035CE4E8B399CF7E9845D784

Function 00007FF600FE85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF600FE85EC
GetDeviceCaps.GDI32 ref: 00007FF600FE85FD
ReleaseDC.USER32 ref: 00007FF600FE860A

Strings

, xrefs: 00007FF600FE8610

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 9c02ad113020ec9a4a0281cc1e7c07715f9f06046ba60d5a3b213ab2dced8faf
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 19E0C220B0864186FB0857B6F58903A2261AB4CBD0F298435EA5F87794CE3CC8C94308

Function 00007FF600FCD1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF600FCD46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCD560

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction ID: 9fc16c84f9c6e12c4628b86e04d0e2cb55c81f678a032f8b95b212272479718f
Opcode Fuzzy Hash: 6a66750d7d38e285348c6a4672a5517d432b12a502a6a2b91e6f62eece89d76d
Instruction Fuzzy Hash: 44A1C162A1CA82A1EA10DB64E9425FD6361FF81784F605932EE9D83BEDDF3CE544D300

Function 00007FF600FE0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF600FE05FC
SetLastError.KERNEL32 ref: 00007FF600FE0697

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction ID: 2026dc1a214e40f079704f4a26b6fe2ae886606a7f55bdf924ae3465a3926324
Opcode Fuzzy Hash: 47ce399c8b5a93a9ee7e183f504d796df39c479f65169f8ae0637efe197c3b7b
Instruction Fuzzy Hash: CD51AE72B58B42A5FB00AB74D4452FC2321EB85B98F604232DE5D97B9AEE6CE241D344

Function 00007FF600FE9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF600FE9DBC
GetLastError.KERNEL32 ref: 00007FF600FE9E08
CreateDirectoryW.KERNEL32 ref: 00007FF600FE9F10
LocalFree.KERNEL32 ref: 00007FF600FE9F20

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction ID: f4d7817a5ef5c8d4a964f1524902ca94e1be4f3e6159e0dca839d4d4968bda2e
Opcode Fuzzy Hash: 91dec681af915968dd102d853b3eeeabd4842e789cbe2ad92d88e952f467e522
Instruction Fuzzy Hash: 0B517D32A1CB8296EB40CF21E4447AE73A4FB84B84F605036EA8E97B58DF7CD445CB50

Function 00007FF600FFDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF600FFDC81
GetLastError.KERNEL32 ref: 00007FF600FFDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFDCD6

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 0705d09163b2dc65969f46b6dd9bda833309fd4354ff3bdfcb5bafe28fdd887e
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: AA418E32A4C68266FB659E109044379B6AAEF80B94F358131DF4DC7B9DDF7CD841E601

Function 00007FF600FD3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF600FD39BD
MoveFileW.KERNEL32 ref: 00007FF600FD3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD3AF1

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction ID: 6f8bc11c618e4b840b0e1be07e1e8b2e9eadf28f3bf93f7a7c50e9c6facf57a8
Opcode Fuzzy Hash: 47dbf0decc8272d9a7ae459b130201949f9107b8ec80fb87a20ec63cf3da1f82
Instruction Fuzzy Hash: E4419E62F18B5294FB00CF75D8851AC2376BF44BA8B205232EE9EA7B99DF7CD145D200

Function 00007FF601000B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF600FFC45B), ref: 00007FF601000B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF600FFC45B), ref: 00007FF601000BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF600FFC45B), ref: 00007FF601000C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF600FFC45B), ref: 00007FF601000C57

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 21e8564ffa9c52170b54b9fc233066812932bb9581415eedf76f67be150afcc2
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 06217331F19B5581E7259F126440529B6A5FF94BD0F688135EECFA3BA8DF3CE4528308

Function 00007FF600FFD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF600FF7F28,?,?,?,00007FF600FF9D35), ref: 00007FF600FFD44A
SetLastError.KERNEL32(?,?,?,00007FF600FF7F28,?,?,?,00007FF600FF9D35), ref: 00007FF600FFD4B2
SetLastError.KERNEL32(?,?,?,00007FF600FF7F28,?,?,?,00007FF600FF9D35), ref: 00007FF600FFD4C8
abort.LIBCMT ref: 00007FF600FFD4CE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 8a0a9fcaf19178defe716c5ed62d22b8a103b5224abe9b2230e9cc27aa9676b3
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 8D014820F4D60262FB59AB71A65923822AA6F44790F344439ED5FC7BDEED3CF844E210

Function 00007FF600FE8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF600FE8598
GetDeviceCaps.GDI32 ref: 00007FF600FE85AE
GetDeviceCaps.GDI32 ref: 00007FF600FE85C2
ReleaseDC.USER32 ref: 00007FF600FE85D3

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 48be6a89f131cde98aab5574ec6460ef76a4aaa42f6ef36e971cb867e19c0b21
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 43E01260E4970682FF085B71E8991363190AF59741F384439DC5FC7394DD3CA889C718

Function 00007FF600FCE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FCE549

Strings

DXGIDebug.dll, xrefs: 00007FF600FCE35A

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 0a6e8a5cf670b8866c9f9b50e0138bc92bc45c918b99fe1d1ba172bd3edf1b53
Instruction ID: 854d989dae02e57b1eaa14bc16b5d612dda2e422cb7aa107f53175264972f380
Opcode Fuzzy Hash: 0a6e8a5cf670b8866c9f9b50e0138bc92bc45c918b99fe1d1ba172bd3edf1b53
Instruction Fuzzy Hash: 6371CD72A18B81A2EB14CB25E5403ADB3A9FB54794F244636DFAC43B99DF78E061D300

Function 00007FF600FFE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFE237

Strings

e+000, xrefs: 00007FF600FFE2DF
gfff, xrefs: 00007FF600FFE362

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 9b3e02487de6ea5acc4a705d7bbf949225d67321f66337fdab6a568838703227
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 45511462B5C7C266E7258F35994037D6B99AF81B90F188231CA9CC7BE9DF2CD444D700

Function 00007FF600FD9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FD95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FD95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF600FD95A2

Strings

SIZE, xrefs: 00007FF600FD9443

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: bdb04f8fd5fe28ffdbf017a385569e76637737b6f63d9701f6f5a3e2e271a3ef
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: E041D362A1C782A5EA11DB64E4413BD7351EF85790F644232EE9D837DEEEBCE540D700

Function 00007FF600FFC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF600FFC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF600FF2CD5), ref: 00007FF600FFC30B

Strings

C:\Users\user\Desktop\0442.pdf.exe, xrefs: 00007FF600FFC2F9

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\0442.pdf.exe
API String ID: 3307058713-1489544898
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: f59507809f7837896e262ebef9fb34fe4d9a55a4ae1ed84d8e908875ece224b0
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: C0419F32A4CA6696EB15DF25A5400BC77A8FF84BD4F648036ED8E87B49DE3DE441D340

Function 00007FF600FE9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF600FC255C: GetDlgItem.USER32 ref: 00007FF600FC25AC
Part of subcall function 00007FF600FC255C: SetWindowTextW.USER32 ref: 00007FF600FC25C8

EndDialog.USER32 ref: 00007FF600FE9C24
SetDlgItemTextW.USER32 ref: 00007FF600FE9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF600FE9B72

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction ID: e3cd6dd14f108f72bcc7fd5c49719fc0292a8de6179382245be6331d1afb9fec
Opcode Fuzzy Hash: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction Fuzzy Hash: DE419122A0C682A1FB10AB16E5512BA33A1BF95BC4F340035DE4E8779DEE7CE941D350

Function 00007FF600FD9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF600FD96EA

Part of subcall function 00007FF600FE0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF600FE0F99

Strings

$%s, xrefs: 00007FF600FD96D7
@%s, xrefs: 00007FF600FD96CE

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: b6112a1e59e3c84ed411d1e9d28721715a5e1a07827c57278802fb453b437c9a
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 4E31CF72B1CA86A6EB508FA6E4406E923B1FB44788F601037EE4D87799EE7CE505D740

Function 00007FF600FFEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF600FFEB76
GetFileType.KERNEL32 ref: 00007FF600FFEB8C

Strings

@, xrefs: 00007FF600FFEBB7

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: b0546776f1a9abd580eccc392eba4907397065a45a429acb53c3e7fd4e650401
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: DB216422A4CA8251EB748B2594901392659EF85774F381336DBAF877FCDE3DD881E341

Function 00007FF600FF4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF600FF1D3E), ref: 00007FF600FF40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF600FF1D3E), ref: 00007FF600FF4102

Strings

csm, xrefs: 00007FF600FF40EF

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: f952311a851c13049ddf4ee1bd18a2e76db89a462cac040c1cd59593731a91ff
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: FB114F32A08B4182EB218F15E44026A77E5FB88B94F288231DFCD47B68DF3DD555CB00

Function 00007FF600FDEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF600FDE95F,?,?,?,00007FF600FD463A,?,?,?), ref: 00007FF600FDEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF600FDE95F,?,?,?,00007FF600FD463A,?,?,?), ref: 00007FF600FDEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF600FDEA78

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: ef1feab09cc1b405a03049f1837633b9abe24079d63451ee5d54a60e314cd9c7
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 84E04F25E1990291F700AB20DC435B822117F65774FB04332E87FC22F99F2CA9859704

Function 00007FF600FDA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF600FDA447
FindResourceW.KERNEL32 ref: 00007FF600FDA45D

Strings

RTL, xrefs: 00007FF600FDA453

Memory Dump Source

Source File: 00000000.00000002.1700660620.00007FF600FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF600FC0000, based on PE: true

Associated: 00000000.00000002.1700621429.00007FF600FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700739213.00007FF601008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF60101B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700773722.00007FF601024000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700832443.00007FF60102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff600fc0000_0442.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: db0bbdc86d2b0f332fc59fab069c60f0d0208288643af697af96bcdbdb76c26d
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: E3D05E91F0960282FF1A9F71A4493B412506F1DB41F68903ACD8F86395EE6CD098C759

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0442.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5511f6.rbs

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Windows Analysis Report
0442.pdf.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre