Edit tour

Windows Analysis Report
Pralevia Setup 1.0.0.exe

Overview

General Information

Sample name:	Pralevia Setup 1.0.0.exe
Analysis ID:	1583869
MD5:	460feb84c01602f95e4314ad2ddb601c
SHA1:	01867f8362f5710d61a0e53169f0165c93ffd164
SHA256:	4cc3fa8aaec18a08fdf93e25cb1b22bbabc79b8a85a50ddedbbc33ed67b2c7bf
Tags:	exeuser-lontze7
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops large PE files

Tries to steal communication platform credentials (via file / registry access)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May check the online IP address of the machine

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Pralevia Setup 1.0.0.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe" MD5: 460FEB84C01602F95E4314AD2DDB601C)

cmd.exe (PID: 7344 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Pralevia.exe" | find "Pralevia.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7396 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7404 cmdline: find "Pralevia.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

Pralevia.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" MD5: 195BD5803C03DDD47267FE9E8FB71430)

Pralevia.exe (PID: 4432 cmdline: "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2 MD5: 195BD5803C03DDD47267FE9E8FB71430)

Pralevia.exe (PID: 1368 cmdline: "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3 MD5: 195BD5803C03DDD47267FE9E8FB71430)

Pralevia.exe (PID: 7088 cmdline: "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8 MD5: 195BD5803C03DDD47267FE9E8FB71430)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Pralevia Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f2f280ca-ea94-5909-818f-3ad4f006967d

Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs\Pralevia\LICENSE.electron.txt

Jump to behavior

Source: Pralevia Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: vulkan-1.dll.pdb source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1939179421.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, Pralevia Setup 1.0.0.exe, 00000000.00000003.1938989177.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Pralevia Setup 1.0.0.exe, 00000000.00000003.1939352483.0000000005672000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs\Pralevia\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs\Pralevia	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: i7next.me

Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: elevate.exe.0.dr	String found in binary or memory: http://int3.de/
Source: Pralevia Setup 1.0.0.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/a/22747272/680742
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tanyabrassie.com/
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438).
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=frCtrl$1
Source: zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: zh-CN.pak.0.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://feross.org
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://feross.org/support
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-styles?sponsor=1
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/issues/154
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/issues/166
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/issues/219
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/feross/buffer/pull/148
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/minipass.git
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob/issues/167
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob/issues/205
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex.git
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/feross
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/isaacs
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/emoji-regex
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://myactivity.google.com/
Source: fr.pak.0.dr	String found in binary or memory: https://passwords.google.comCompte
Source: zh-CN.pak.0.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://policies.google.com/
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: zh-CN.pak.0.dr, fr.pak.0.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: zh-CN.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.0.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&AideG
Source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.patreon.com/feross

Source: unknown	Network traffic detected: HTTP traffic on port 64903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64903
Source: unknown	Network traffic detected: HTTP traffic on port 64906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64906

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File dump: Pralevia.exe.0.dr 188851200

Jump to dropped file

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_00404C9E	0_2_00404C9E

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Process token adjusted: Security

Jump to behavior

Source: Pralevia.exe.0.dr

Static PE information: Number of sections : 15 > 10

Source: Pralevia Setup 1.0.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.spyw.winEXE@15/93@2/2

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Mutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Mutant created: \Sessions\1\BaseNamedObjects\f2f280ca-ea94-5909-818f-3ad4f006967d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Temp\nslCE03.tmp

Jump to behavior

Source: Pralevia Setup 1.0.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'PRALEVIA.EXE'

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File read: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe "C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe"
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Pralevia.exe" \| find "Pralevia.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "Pralevia.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe"
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Pralevia.exe" \| find "Pralevia.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "Pralevia.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d12.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d12.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d12core.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: dxilconv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: d3dscache.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: directml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Section loaded: cabinet.dll	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe"

Source: Pralevia.lnk.0.dr	LNK file: ..\..\..\..\..\Local\Programs\Pralevia\Pralevia.exe
Source: Pralevia.lnk0.0.dr	LNK file: ..\AppData\Local\Programs\Pralevia\Pralevia.exe

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\f2f280ca-ea94-5909-818f-3ad4f006967d

Jump to behavior

Source: Pralevia Setup 1.0.0.exe

Static file information: File size 93419212 > 1048576

Source: Pralevia Setup 1.0.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source:	Binary string: vulkan-1.dll.pdb source: Pralevia Setup 1.0.0.exe, 00000000.00000003.1939179421.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, Pralevia Setup 1.0.0.exe, 00000000.00000003.1938989177.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Pralevia Setup 1.0.0.exe, 00000000.00000003.1939352483.0000000005672000.00000004.00000020.00020000.00000000.sdmp

Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: Pralevia.exe.0.dr	Static PE information: section name: .gxfg
Source: Pralevia.exe.0.dr	Static PE information: section name: .retplne
Source: Pralevia.exe.0.dr	Static PE information: section name: .rodata
Source: Pralevia.exe.0.dr	Static PE information: section name: CPADinfo
Source: Pralevia.exe.0.dr	Static PE information: section name: LZMADEC
Source: Pralevia.exe.0.dr	Static PE information: section name: _RDATA
Source: Pralevia.exe.0.dr	Static PE information: section name: malloc_h
Source: Pralevia.exe.0.dr	Static PE information: section name: prot
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: 877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node.8.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\WinShell.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File created: C:\Users\user\AppData\Local\Temp\877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File created: C:\Users\user\AppData\Local\Temp\18ab4b65-60db-48a2-badd-b493a695faed.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\Uninstall Pralevia.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\pralevia-updater\installer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Programs\Pralevia\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File created: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\System.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File created: C:\Users\user\AppData\Local\Temp\877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File created: C:\Users\user\AppData\Local\Temp\18ab4b65-60db-48a2-badd-b493a695faed.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File created: C:\Users\user\AppData\Local\Programs\Pralevia\LICENSE.electron.txt

Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pralevia.lnk

Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\WinShell.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\18ab4b65-60db-48a2-badd-b493a695faed.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\Uninstall Pralevia.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Pralevia\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\System.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\Pralevia FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\Pralevia FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs\Pralevia\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs\Pralevia	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	File opened: C:\Users\user\AppData\Local\Programs	Jump to behavior

Source: Pralevia Setup 1.0.0.exe

Binary or memory string: iQemu"

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

API call chain: ExitProcess graph end node

graph_0-3407

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Pralevia.exe" \| find "Pralevia.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "Pralevia.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\pralevia" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\pralevia" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\pralevia" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Process created: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe "c:\users\user\appdata\local\programs\pralevia\pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\pralevia" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData\Local\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Pralevia VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Pralevia\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\Pralevia\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Windows\System32\cmd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe

0_2_0040338F

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	file Attributes Queried: C:\Users\user\AppData\Local\Discord	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	file Attributes Queried: C:\Users\user\AppData\Local\DiscordCanary	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	file Attributes Queried: C:\Users\user\AppData\Local\DiscordPTB	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	12 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Access Token Manipulation	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Process Injection	11 Process Injection	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	1 Clipboard Data	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	Software Packing	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	26 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pralevia Setup 1.0.0.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\Uninstall Pralevia.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\Pralevia\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\18ab4b65-60db-48a2-badd-b493a695faed.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\WinShell.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsis7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\pralevia-updater\installer.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://passwords.google.comCompte	0%	Avira URL Cloud	safe
http://int3.de/	0%	Avira URL Cloud	safe
https://feross.org/support	0%	Avira URL Cloud	safe
https://mths.be/emoji-regex	0%	Avira URL Cloud	safe
http://blog.izs.me/)	0%	Avira URL Cloud	safe
https://passwords.google.comGoogle	0%	Avira URL Cloud	safe
https://mths.be/emoji	0%	Avira URL Cloud	safe
https://sindresorhus.com	0%	Avira URL Cloud	safe
http://tanyabrassie.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
77980.bodis.com	199.59.243.228	true	false	high
ipinfo.io	34.117.59.81	true	false	high
i7next.me	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=zh-CNCtrl$1	zh-CN.pak.0.dr	false		high
https://creativecommons.org/licenses/by-sa/4.0/	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/isaacs/node-glob/issues/205	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/isaacs/node-glob/issues/167	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.html	zh-CN.pak.0.dr	false		high
https://github.com/mathiasbynens/emoji-regex.git	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/feross/buffer/issues/219	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/isaacs/minipass.git	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://passwords.google.comCompte	fr.pak.0.dr	false	Avira URL Cloud: safe	unknown
http://int3.de/	elevate.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://myactivity.google.com/	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u	fr.pak.0.dr	false		high
http://stackoverflow.com/a/22747272/680742	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.patreon.com/feross	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/sponsors/isaacs	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://policies.google.com/	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/chalk/ansi-styles?sponsor=1	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/sponsors/feross	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mathiasbynens.be/	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.html&AideG	fr.pak.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://feross.org/support	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mths.be/emoji-regex	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/category/extensions	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://support.google.com/chromebook?p=app_intent	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://chrome.google.com/webstore?hl=frCtrl$1	fr.pak.0.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=695438).	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sindresorhus.com)	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/feross/buffer/pull/148	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tanyabrassie.com/	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mths.be/emoji	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://passwords.google.comGoogle	zh-CN.pak.0.dr	false	Avira URL Cloud: safe	unknown
https://sindresorhus.com	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Pralevia Setup 1.0.0.exe	false		high
https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/feross/buffer/issues/154	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://feross.org	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.izs.me/)	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://support.google.com/chrome/a/answer/9122284	zh-CN.pak.0.dr, fr.pak.0.dr	false		high
https://github.com/feross/buffer	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/feross/buffer/issues/166	Pralevia Setup 1.0.0.exe, 00000000.00000003.1832422346.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity	zh-CN.pak.0.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	zh-CN.pak.0.dr, fr.pak.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.117.59.81	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
199.59.243.228	77980.bodis.com	United States		395082	BODIS-NJUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583869
Start date and time:	2025-01-03 19:40:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pralevia Setup 1.0.0.exe
Detection:	MAL
Classification:	mal48.spyw.winEXE@15/93@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 23.56.254.164, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Pralevia Setup 1.0.0.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	ipinfo.io/json
	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
199.59.243.228	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.denture-prices.click/dx3i/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77980.bodis.com	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	Tbconsulting Company Guidelines Employee Handbook.docx	Get hash	malicious	Unknown	Browse	199.59.243.227
	Tbconsulting Company Guidelines Employee Handbook.docx	Get hash	malicious	Unknown	Browse	199.59.243.227
	RFQ.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	statement of accounts.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	RFQ.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
ipinfo.io	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	34.117.59.81
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	main1.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	pyld611114.exe	Get hash	malicious	Unknown	Browse	34.117.59.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	http://www.klim.com	Get hash	malicious	Unknown	Browse	34.117.77.79
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	random.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	34.117.77.79
	Etqq32Yuw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
BODIS-NJUS	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	199.59.243.228
	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	199.59.243.227
	Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	199.59.243.227
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	rQuotation.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	https://tfsroanoke.com/home/tfs/public_html/new/ckfinder/userfiles/files/12719803849.pdf	Get hash	malicious	PDFPhish	Browse	199.59.243.205
	Tbconsulting Company Guidelines Employee Handbook.docx	Get hash	malicious	Unknown	Browse	199.59.243.227
	htkeUc1zJ0.exe	Get hash	malicious	Unknown	Browse	199.59.243.227

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll	YoS6ZBCcUy.exe	Get hash	malicious	Unknown	Browse
	G4fDWS1Fpd.exe	Get hash	malicious	Unknown	Browse
	a2zZyepQzF.exe	Get hash	malicious	RHADAMANTHYS	Browse
	kCKthbZCUf.exe	Get hash	malicious	Unknown	Browse
	G4fDWS1Fpd.exe	Get hash	malicious	Unknown	Browse
	a2zZyepQzF.exe	Get hash	malicious	RHADAMANTHYS	Browse
	kCKthbZCUf.exe	Get hash	malicious	Unknown	Browse
	cMqyGFCQHk.exe	Get hash	malicious	Unknown	Browse
	cMqyGFCQHk.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.012588069182000032
Encrypted:	false
SSDEEP:	3:xqK9lllGlll/l/lXp9ZjrPBY0Hl8lt/HvXZP:xFll0dPBY0Snh
MD5:	87FDAB466342AB84BBECB3C17BE3B25A
SHA1:	F07A4CC8DCF7CE7E06A9FB3E1CE10D18A11DF20B
SHA-256:	5887817FCD5A121DE6F80F1C94417B485F3BC1AC513D811FB52528DBB3DFB711
SHA-512:	A3D18DBFDA1F8B24BF818919DD22349EFB17A6A80716CB1378907897E4618488AECC6CA35B689C42A1F86F098BBA6546F59A9DCBBFAED6A3F64919C1A3B50BF3
Malicious:	false
Reputation:	low
Preview:	..[.........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.026843120645871483
Encrypted:	false
SSDEEP:	3:9llrd2DJqojrwRAal0dhOEjlpQlyEXl1lAbl7xeTuTlMlM5v0TuTlMlMLHtt3lle:69q0sRKUEZ+lX1IbR44MR4MYtT2Hrn
MD5:	D5D2A70B7E49D081EB40778E625DA553
SHA1:	31991800A1FFDA7A5F8D9D77DC59515EE687AB6D
SHA-256:	E6095ECE9FC607EC1F6BBD7A68125DBB1E23282B7110BF155931D9CBD090AB45
SHA-512:	E9B5DB200A06DEC647C65282B39A459755E49173B2A389B5F36901DBC91196A32B33F20AD527869CD742863802C510CA76C419F0E46EC8D6B7D4E928F59AA0AF
Malicious:	false
Preview:	................x...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.P.r.a.l.e.v.i.a.\.P.r.a.l.e.v.i.a...e.x.e.......................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Programs\Pralevia\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9099045
Entropy (8bit):	4.754770173605162
Encrypted:	false
SSDEEP:	24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
MD5:	6FF57C0AECCDF44C39C95DEE9ECEA805
SHA1:	C76669A1354067A1C3DDBC032E66C323286A8D43
SHA-256:	0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
SHA-512:	D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	188851200
Entropy (8bit):	6.760041149743257
Encrypted:	false
SSDEEP:	1572864:w4SuXYuY8+xLxZu3Jidykta0iObusUd557Y8mn/XJjU0X+6s/na9ujx1JE+t8tT7:TWo3Cc1j9X
MD5:	195BD5803C03DDD47267FE9E8FB71430
SHA1:	F1AF5C9389B2B45471D1C20A53E90C37F709F3E3
SHA-256:	296BCF01EF62519191529DA535D5A51F074855BE68EC94B079F46663C5975CBF
SHA-512:	9775FBAAE8B46804F6008D382047D0D090E3AA69C7DDAF21934F37D332E5633D831543CF636F6DDCEC419A1E8ADA9113D989793942A9640187529DCF924A31BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........."......LJ..*........[........@..........................................`.............................................k.......h.....p..b...@&...H..........pq.P@...%....................... ..(....}J.@...........X.......`........................text....JJ......LJ................. ..`.rdata...$...`J..$...RJ.............@..@.data.....H......L...v..............@....pdata....H..@&...H.................@..@.gxfg....B....o..D....0.............@..@.retplne.....`o.......0..................rodata......po.......0............. ..`.tls..........o.......0.............@...CPADinfo8.....o.......0.............@...LZMADEC.......o.......0............. ..`_RDATA........o.......0.............@..@malloc_h......o.......0............. ..`prot..........o.......0.............@..@.rsrc....b....p..d....0.............@..@.reloc..P@...pq..B...b2.............@..B................

C:\Users\user\AppData\Local\Programs\Pralevia\Uninstall Pralevia.exe

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	152599
Entropy (8bit):	7.475791979144185
Encrypted:	false
SSDEEP:	3072:gn77v00hEoDEtauTT5nIXza/7i42YJkaH2tvhOEA1RJCir86SrSrv6Ia34:g740IDThYzQ7fks2t0EyL+yao
MD5:	E642DFFB052EB6B17C58F29755B7C25E
SHA1:	210FA74309B3C7996475F07852BC8F7BB3C10B8D
SHA-256:	129D7C40721374438684F550F017145C7530D97D94DC3803958E8010A9213414
SHA-512:	CEBB46AB4F3BA149FC8749214E8510263321A576F984163043ADDCE3397D39B27660BD2E0565126FA6565C231EDE3A0A879C50B3794725C04AF2E0D2028CC641
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.......................................@..........................................0..H............................................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...H....0......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	151599
Entropy (8bit):	7.915992368779121
Encrypted:	false
SSDEEP:	3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
MD5:	83EC43F2AF9FC52025F3F807B185D424
SHA1:	EA432F7571D89DD43A76D260CB5853CADA253AA0
SHA-256:	A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
SHA-512:	6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
Malicious:	false
Preview:	..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..\|..I..}..J..~..M.....O.....R....\|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~...............m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................\|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

C:\Users\user\AppData\Local\Programs\Pralevia\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	228644
Entropy (8bit):	7.946488830213853
Encrypted:	false
SSDEEP:	6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
MD5:	DC48A33BD20BFC7CACFC925A84B015B6
SHA1:	8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
SHA-256:	2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
SHA-512:	1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
Malicious:	false
Preview:	..........<.........&...h.....i.....j.....k.....l.....n.....o.\|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...\|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....\|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916728
Entropy (8bit):	6.398031738914566
Encrypted:	false
SSDEEP:	49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5:	A7B7470C347F84365FFE1B2072B4F95C
SHA1:	57A96F6FB326BA65B7F7016242132B3F9464C7A3
SHA-256:	AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
SHA-512:	83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: YoS6ZBCcUy.exe, Detection: malicious, Browse Filename: G4fDWS1Fpd.exe, Detection: malicious, Browse Filename: a2zZyepQzF.exe, Detection: malicious, Browse Filename: kCKthbZCUf.exe, Detection: malicious, Browse Filename: G4fDWS1Fpd.exe, Detection: malicious, Browse Filename: a2zZyepQzF.exe, Detection: malicious, Browse Filename: kCKthbZCUf.exe, Detection: malicious, Browse Filename: cMqyGFCQHk.exe, Detection: malicious, Browse Filename: cMqyGFCQHk.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2927616
Entropy (8bit):	6.705014034253491
Encrypted:	false
SSDEEP:	49152:o/Prfh/7w2EsYHhrNnpSMGH6qfBvvnIS5ikbUaRkY:o/Pp7wpLBrNnpSF55igA
MD5:	122AC1450759999A23BB68230770D998
SHA1:	72142D71A8FA21E4A54D23FCE08D817CFD4C7ED7
SHA-256:	015C30885776C9FE35242BC7ED612C1A3CAAF737C4D3116A443E2C473CD87270
SHA-512:	FA0D26B23C2E1A7395BBE63615B103581C0F1FC7663530E154AB569CA28723303738B8C54C3569F9FC1B1A842064DB57CFFD95A71CFE711F1B91F6A364D664EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........." ......#...................................................:...........`A..................................................(.............9..............:.<5............................(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."...\|+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...D,.............@..@.retplne.....`:......p,..................tls.........p:......r,.............@..._RDATA........:......t,.............@..@.reloc..<5....:..6...v,.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	10468208
Entropy (8bit):	6.265606239082294
Encrypted:	false
SSDEEP:	196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
MD5:	FFD67C1E24CB35DC109A24024B1BA7EC
SHA1:	99F545BC396878C7A53E98A79017D9531AF7C1F5
SHA-256:	9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
SHA-512:	E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q.>L..`..gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

C:\Users\user\AppData\Local\Programs\Pralevia\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	493056
Entropy (8bit):	6.367458145439831
Encrypted:	false
SSDEEP:	6144:Auf2dkQcAxA+q6RBo8FrjSUPa87/vmddEnikirIhd2p2:bk6z6RG8Frj9bvyEnikirU1
MD5:	50E76B71CBA1747050F591F60D49A465
SHA1:	21D9652102D47BBF818F2A41EBC6E888D88EADE9
SHA-256:	071160C865FAC5BC6C232A10B1906CDA0C4315FCF8C5349541CC709E9BCF386C
SHA-512:	6923968062CEE0D1660280FCD386F13C3B5650D49B73DD66F9C6F4634CB6314D2132D47E161671D41DC355C08BDC55DCDB5B9C566B633DB52270A293E23DC312
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........." .....l..........@.....................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text...jk.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8418304
Entropy (8bit):	6.508649088679547
Encrypted:	false
SSDEEP:	49152:a5cuyPXoUUELhguXVfZ7S7LANafEwDpiGCfE9GhGHLYJZk2yGU6reDT8tjDJXMbG:PNES1f2VivcbfZK47NfX436uigE
MD5:	E450B4432235E3EF2AB86F9F12E14680
SHA1:	A6E9F17508D126DDBE5D47C7991512C304B35CF5
SHA-256:	C57CF0D74EDDD6324A437D3E210949AE39B15C6F058B0828F3CDE07C11B6C52C
SHA-512:	ECAAA302C410EBE004BEE4D6C93A7ECDCAD3257B126EA2D27AAF4F91708876364AD44877E4B107B2D0B88AE8530A83DD6E9D33BB19606D03EA32D9EBCB93D17C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........." ......d..........N......................................`............`A..........................................w.......x.d....p........}..H..................<.w.......................w.(.....d.@.............x.......w.@....................text....d.......d................. ..`.rdata..d.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\locales\af.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	533447
Entropy (8bit):	5.412082885517651
Encrypted:	false
SSDEEP:	12288:WEG8+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:WC+ozrc86VZBaja+H2Jyngae5Ig1eo0N
MD5:	FC32A6B72FC91E1BE9C2C9D2EA586EC3
SHA1:	5D439600CFF26476D8715B778881F5735356D723
SHA-256:	C56CB2841EE2E40FBDD6B7E293A1CE74BD10FD500465FCF99D1E07F8D69F8CE7
SHA-512:	B34C7390D4A15936B1F74F42FA91CCD0CA0587F0DD630096C9A16EC77756E2137D9E49AB1EBBF703C8CE6F56F110D5BB3333B1EBED51779D1BB2460B203A7250
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...\|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q...................1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....\|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

C:\Users\user\AppData\Local\Programs\Pralevia\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	860999
Entropy (8bit):	4.907165215736528
Encrypted:	false
SSDEEP:	24576:odLToH2hTCNRysrxQH9hjN3fpzvh51muMXqVFq+XG/6WxLP5A:e5N
MD5:	873548BF4AB0FEADF7C83068036377CA
SHA1:	B0B4311D02A1BE1933FA90233E436E23DA178640
SHA-256:	8F46CCB4459B50FE06C4F825DD42C4D458DCC05DF9631FDFB9D5A0926038246E
SHA-512:	0EE9A1046D4FBDE5A7CAA7D922D3ED910023337D87E727B9A216F07C43F511563B93910E1992B9F8DF6DBCF96C7F527451F2EBFA48868724B83297A50F34D202
Malicious:	false
Preview:	.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...\|.....}.................................................$.....%.....&.....+.....G.....].......................^...................................4.................Q...........C...........N.................v.................Q ..... .....!....,!.....!....N".....".....".....#....\$.....$.....$.....%.....&....a&.....&....,'.....'.....(....?(.....(....y).....).....)..........+.....,....F,.....,.....-....A-....t-.....-....L................../....u/...../...../....s0.....1....w1.....1....>2.....2.....3....D3.....3....a4.....4.....4....]5.....5..../6....N6.....6....R7.....7.....7....^8.....9.....9.....9.....:.....:.....:.....;.....;.....;....4<....\<.....<....a=.....=.....=....y>.....>....`?.....?....(@.....@.....@.....@.....A.....B....PB....oB....C.....C.....D....5D.....D.....E....RF....lF....7G.....G....LH.....H....JI.....I....^J.....J.....J....DK....jK....}K....6L.....L....4M

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	943178
Entropy (8bit):	4.930429563629583
Encrypted:	false
SSDEEP:	12288:aJnSBUC/+/RnfESugvPUz6m7kOCSn5KNp5QpnSEUt:wgP5aQ0
MD5:	8D4AB96DF9BE981C11A48955117463C2
SHA1:	338EB5752BDEFA22CD0DB3853B9A45D5D6BC0D27
SHA-256:	E8D59CB109F5F6A923281C619BA1EACBE795C88A3DA30C3FCB960A54230627BF
SHA-512:	D7BB3B9B96E5AE4D12D7E937A13CA839232CF06D1F172602FB7A250C9C17D0119C53CA308092C0EF4D0E7A3CD34F5A25FFC1FD54A222304A3A203F0899F122C5
Malicious:	false
Preview:	........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....\|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....\|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

C:\Users\user\AppData\Local\Programs\Pralevia\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	982837
Entropy (8bit):	4.669921762719658
Encrypted:	false
SSDEEP:	24576:MhrgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:+gWoOYLYfYUPVbKDks373ZN3ApmVDLpw
MD5:	D9D3B4D420BE9277D69584A3C0B5080A
SHA1:	285A094979B739C4455E3790968D33CA4D466146
SHA-256:	F08DE6909FAF88465C28388AA03FDF08E165866A5A23C738ED33382275C4EC83
SHA-512:	388CA1CC11485FD3D31A7FBF710145CBD480CB386D96CF6DFD83E1EF2F5376DF76DB5C2CB051C5A045452875F8362890CBC6DF547200BEC624C9F13636655803
Malicious:	false
Preview:	.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...\|.....}.................................................#.....$.....%..........L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

C:\Users\user\AppData\Local\Programs\Pralevia\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1267393
Entropy (8bit):	4.2843443298297235
Encrypted:	false
SSDEEP:	3072:LEcoGqGB2le1abaCb6Ew/0WySZISex22f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0zpgpCOXqB+iBbD5YqNn
MD5:	C798CC5946A04209CB601637FDA7E573
SHA1:	C4A503FE368980D12E097792FA67B76B5934ADE7
SHA-256:	C48B7423D5638B09860ED1ED4A0741890DC4B3F7C9E682E94867EB8441D196BA
SHA-512:	7EF077CD66508D47EF4F0E5EC98FD3F18469B66FDD468C9F8EB71E1A960042B12AC9F185FBF598544997CBF7DD7DE5694C7BFD7F8B9D7D5C267BAF81218CCC2B
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...\|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^..........+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	598917
Entropy (8bit):	5.409041319245187
Encrypted:	false
SSDEEP:	12288:BVdZr7D1MeCi24V3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOwjcXR2lxQE8h:BVHRVoiL6MhgMNxgQh5vfScs
MD5:	F20051B4128957C1637C01EAD53B97F2
SHA1:	DFA1CB8288E5489F126BB6998581176AC3F296E0
SHA-256:	06809011053B482B4830517039057C65021783129CC90B20857141D4F37CE9BB
SHA-512:	D63AB5D8B0641B6EB984FA9162A565BDA14692B86B18D69E4B676D6F2E894D2317022D713BC726F94578C9518162479AB68FF6E52F5C60BCEE416DF79A1B2A18
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...\|.{...}.........................................................................%.....>.....^.....\|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H....s...............+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

C:\Users\user\AppData\Local\Programs\Pralevia\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	616999
Entropy (8bit):	5.843780325387443
Encrypted:	false
SSDEEP:	6144:863oqX0g5QkuA9jN85ASh6mARAO52C+wH/NOnbJSBXR8QQ:VYmB85AS0P52C+wH/NObJS+
MD5:	D661BFA360061A0D0F18024CBC00BB6A
SHA1:	8603B59DC08B8256B242332EFFBC0430677AA8D7
SHA-256:	690F31ABC263F7C479531B267909777DCB20C680B3CF7801B287860D2415AF3F
SHA-512:	52C3C82E6F08FE0C2A2CD9B22AA185084D0378F75A6B8BB53D012A1C56A12231540B819724A76AB622A36D9165237299727D1CC0BA49C04C0314BA9BF2CE7E57
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...\|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."...................:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

C:\Users\user\AppData\Local\Programs\Pralevia\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	558863
Entropy (8bit):	5.449472987304629
Encrypted:	false
SSDEEP:	6144:Hfstn+siRMmQzVmh5OsLZE1seDrcwlQJWJwgKobwmPaHL95bpkUdRi3jd45FQwA:HUZ+ssLArYb55bpfdNm
MD5:	3C8A4730A2D935DE6ECF17AD8D782F48
SHA1:	F520707CFD5856A8F868099FDB894B41993B1637
SHA-256:	E71730C1BFB469F327212F7488C7674E66A59F857A4BDBB8C7736765215E5FFB
SHA-512:	BC92BF0DC203FE3B65BBBBBACFBF44835D65BF869B91BE292A2F196A34F47A253BE77F4AA2BE8DA3103D6E62FEF0AD93614EA55D3AD28516372D096C60CB39DF
Malicious:	false
Preview:	.........(..e.....h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w."...y.I...z.w...\|.....}...........................................#..........+.....,...........<.....L.....`.....y...........^.........................................j...........?.....[...........+.....[.....o.................E.....R.................0.....>.................6.....P...........<.....x.................u................., ..... ..... ..... ....j!.....!....>"....X"....."....q#.....#.....#....>$.....$.....$.....$....$%....}%.....%.....%.....%....V&....z&.....&.....&....N'.....'.....'.....'....S(.....(.....(.....(....G)....r).....).....)....&....L....V..........+....<+....J+.....+....E,.....,.....,.....-....[-.....-.....-.....-....8.....V.....n............/....2/....B/...../....0....d0.....0.....0....S1....x1.....1.....1....^2.....2.....2.....3....P3.....3.....3.....4.....4.....4.....4....m5.....5.....6....J6.....6.....7....F7....X7.....7.....7.....8.....8.....8.....8.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	596603
Entropy (8bit):	5.505955339175374
Encrypted:	false
SSDEEP:	12288:55U5D5nPs3K7UpGg5aL9Xtt5fPMkUz1CTz:5enPs3K7UpGg5aLRf53MtCTz
MD5:	DD811AE7EE2BEB54B60246E8DCD3E212
SHA1:	967DE04B1C9D98E41DE4AB1C7F73428A2B14D654
SHA-256:	BE0D49BE3B021C0A4D917AD437D8ED817D676C40BCA4FC08F2F9A8B2CBE67FC3
SHA-512:	970135C8591F33D978BC705724C1AB42EAD4050B60BFC5315EA47A9E12CE967F2CF6136F863E772C76EF2550AA36544B5AFBAEF215ACC6CDD547D85CF6FF6FAA
Malicious:	false
Preview:	........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...\|.....}...........................................!.....(.....)..........,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....)..........*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....\|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

C:\Users\user\AppData\Local\Programs\Pralevia\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1076243
Entropy (8bit):	4.760087158985349
Encrypted:	false
SSDEEP:	24576:NvcHcaFbu4FDYX9QnMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQ+:NvcHcaFbu4FDYX9QnMDhWJXDsS7miHci
MD5:	444F3F565941DDD5F108F17C3803079B
SHA1:	F90D186106F1AD8625257B549DD1D0EBD48B623B
SHA-256:	7E54F3C19A0343435685738D41CBEDCBA6B1DF30F6CC837F0B5C27E0A91E2D84
SHA-512:	D6D9AFB0C138CDBF6D5E23D5120B3E953EB1848FA790F481DC92DBFB6B8A084511DEE873ACC0FDEE4188D3A07843635E0231D5A1CF3C3F37545D12E2AA1E0D17
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...\|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t..........+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....\|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

C:\Users\user\AppData\Local\Programs\Pralevia\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	485862
Entropy (8bit):	5.52248996992
Encrypted:	false
SSDEEP:	6144:Ll+NihP3X267KdFkFufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll+APWc0fMuQSK3Z5MxLG
MD5:	5C61ABACFCEC504091C0BDD7EFE9B4DC
SHA1:	FD794FD1EC93028B1CF9EF482B0940F40012A327
SHA-256:	33132446072DDFD058A395AFEEC901D7FAE18505BB48E271CA870A4435D9E338
SHA-512:	A9CC6FC1B3DDF941FCFACF3101600CD9E1FEB664BDA0B0A9F8E5F30BA1DB70590DC148FB0B8CB7F5ADC8DD3CC1ED65187908463CCB923F53EFDC5A1150ABA7C1
Malicious:	false
Preview:	.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...\|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....\|(.....(.....(.....(....>)....z).....).....).....)....>...._....n..........+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

C:\Users\user\AppData\Local\Programs\Pralevia\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	490357
Entropy (8bit):	5.513415827568557
Encrypted:	false
SSDEEP:	6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
MD5:	A99B6152BDEAC44148F94394C4149622
SHA1:	DF7371533E92AA24F48469116D9A8AC73249315E
SHA-256:	75DB989561E145D0D990C4918502316C77CE66B344D3DCE4739E3A6DB43FDE82
SHA-512:	3160B58D10CA147594FF4ACA004007D4E6823421BE349CFAD945C681E220EEC7266D88434A4D31C719A346650AC0ED31F1F13FCA3E824D81BB65EBB4D21CC2C1
Malicious:	false
Preview:	........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....\|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....\|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!...."....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....\|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).........1....................*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

C:\Users\user\AppData\Local\Programs\Pralevia\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	589665
Entropy (8bit):	5.378803794659303
Encrypted:	false
SSDEEP:	6144:cfKWQ1cE01mlpDYl7G8oZOZ5zazaQ+ax891:cyWQPjpuGS5za9+D1
MD5:	3B180E08076AE90821F3B305EE5728EC
SHA1:	690509FA47F843D443C423E0E9B344E4E15BC995
SHA-256:	0EE595AC6814586B46101E854D01CE6B1076092B07AA2564D6C8ADB5D7A082E6
SHA-512:	CDB7B852BF9098813B2FBA593FBC9DCC8136C1E643300E4117948FD49DC9F9779EAA99571D36722DACF38F9C71709778618ED271AADAEB3C2F75641B56A3F867
Malicious:	false
Preview:	.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...\|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2....>..........*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

C:\Users\user\AppData\Local\Programs\Pralevia\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	589271
Entropy (8bit):	5.358553296693886
Encrypted:	false
SSDEEP:	6144:cLfC370f5SWVIhaJ13K4G0gkjqpT+ZqBQihXFijs5JEf2D//z/h6PZOkx:6K36Vmd4LepVBQiXijs5+2r/Lzk
MD5:	FB43793B61C4A62DA84FF340C3A342D7
SHA1:	72941C56A2E268EC7262EFC92BF3CFE9C06D07AE
SHA-256:	31F98FCA9AB6837569315FD1BAAC8FAB16C592B03E47D7E1DFE4C16BB3AC2567
SHA-512:	35572BFFC9B113616958F2AA50265417F22C653C97EAABCEFAD1FE71BCB97B0AEF79EFBE363F5EAA64571A8D4014C614621F3059EE66BC5F77116B9DEDB93E1F
Malicious:	false
Preview:	.........(..e.....h."...i....j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.\|...s.....t.....v.....w.#...y.J...z.x...\|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....)..............k..........*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

C:\Users\user\AppData\Local\Programs\Pralevia\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	536344
Entropy (8bit):	5.456025397333951
Encrypted:	false
SSDEEP:	6144:HeaF27VNhXV9RAOrs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN5Ge6Z8+wmFZq0SfH50MIW
MD5:	ACE748CC20A646162BD473343539D5CE
SHA1:	D9AEBA3004206B76A1F6B23607281B6484DF76D1
SHA-256:	9954E80792A5CAC7B0A7AE2899B0ADAA620AF2F3ED2A273EE65B10B22FFA4BBC
SHA-512:	A9B36941A808C2B93BEB1D3CB4D939CE3333F2F42316B9EB47AD31FBCE85E789230856E43BE1F2660F22677DDBEB192CB492511596EA318A24F158B8C0319571
Malicious:	false
Preview:	.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C...................\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

C:\Users\user\AppData\Local\Programs\Pralevia\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	876048
Entropy (8bit):	5.0513401326920535
Encrypted:	false
SSDEEP:	24576:U+E+8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCqq:m5jv
MD5:	587832600A9D596F526F1EDC8B845B55
SHA1:	1EAB6376BDD341DE25A4017A65508EB5E03AF5A2
SHA-256:	B2D24B4311EDD8E0CAD01308B6667C8BE2FB04CA624666CF0A841E907312B551
SHA-512:	1E1A975FFA69F12EC8F88EAFC80BB8C6C7838A7BE570C3D4FCF471018B2B4D4ACB124205F01B06A4755B1224471C34C7B969D93EFFEBDAC7DC75912E245DFCE9
Malicious:	false
Preview:	........Q(..e.`...h.h...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.@...w.l...y.....z.....\|.....}.......B.....G.....O.....W....._.....f.....m.....t.....v.....{...............................................<.........................................%.....N.................#.....J..................................." ....l ..... ....2!.....!....."....;".....".....#.....#.....$.....$....E%.....%.....%....G&.....&....5'....S'.....(.....(....2)....T)....%.........s+.....+.....,.....,.....,.....,....u-..........9.....J...........j/...../...../....Z0.....0....J1...._1.....1.....2.....2.....2....g3.....3....-4....@4.....4....\5.....5.....5....I6.....6....+7....<7.....7.....8.....8.....9.....9.....:....G:....j:.....;.....;.....;..../<.....<....X=.....=.....=.....>....&?....x?.....?....=@.....@.....@.....@.....A....UB.....B.....B....oC.....C....MD....nD....lE....dF.....G....+G.....G.....H.....H...."I.....I.....J.....J.....J....\|K.....K....$L....EL.....L.....M.....M.....N

C:\Users\user\AppData\Local\Programs\Pralevia\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	547257
Entropy (8bit):	5.4257939508584885
Encrypted:	false
SSDEEP:	12288:sXT/419l5MtWuah5EinUtWnSp0WahHNYM:yTiB5E8nRl
MD5:	B452982F5D1DC232AC8869217348BB74
SHA1:	39CFEFDCE0AD7DBBFD72789EEF4835E25D1585F5
SHA-256:	8D62395944362D437FC1BD7810D8FD037AFCC2F94F56BFAEE4368350C189C106
SHA-512:	F053285F4341E92A6B06BC019A90C461CB76281C8C5D6B8024F8C15EAA20AC42AD7409B71178CA0B9CB5ADBFAC0216D73B9EB63BF8563F1C9F82C1028A5F5C3B
Malicious:	false
Preview:	........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....\|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).........R....n..........*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....\|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

C:\Users\user\AppData\Local\Programs\Pralevia\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	618874
Entropy (8bit):	5.2024854226337265
Encrypted:	false
SSDEEP:	6144:fGsxIsSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:f7ilx5G7s
MD5:	D02D3BB645C67A0A3C12F1D174545B48
SHA1:	6E1AA00C0EB20489AB7E518FAA43F6D3A99EC8F3
SHA-256:	1A6D121FB42A1B2941F2BC3C11C25E2A7C1E96ED845D08CD5F2370B9D399A0BE
SHA-512:	5F3AE15A587F7CC2CDB10A4C1535E039517B08D24BCB8ACBADBB2D2B9BA8425C26852A82441A9A32D190E4C06FD83C80B8D06D4226ECC49DC77DD77A67AC717D
Malicious:	false
Preview:	........)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...\|.....}.....................................#..........1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....)....................*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

C:\Users\user\AppData\Local\Programs\Pralevia\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	637410
Entropy (8bit):	5.391423001823023
Encrypted:	false
SSDEEP:	12288:1SMTx7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmL:scVYVW45g2
MD5:	0EE0556F9FD32215FF5A6B64E1A71A59
SHA1:	8E1C8774DAF341D3B4E541B6BD443F22CB3FBB2E
SHA-256:	4ABF6CE2DE7F20FFAEED953B97D364F08324BBC9819D2AE02A4AAADCF9B88CFF
SHA-512:	BA7BC3637A57B26E990C4E23F3F4A3337A5566D0BCBB46238E58EF774605ECC58055CE32BE01584792D5E0A7986FB59138A690D8BFF86CDAEE434CC8D97735A8
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...\|.d...}.....................................................................................$.....3...........{.................u................B...........`.................H.................+..............................................?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(....\....q.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

C:\Users\user\AppData\Local\Programs\Pralevia\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1247893
Entropy (8bit):	4.323279138519366
Encrypted:	false
SSDEEP:	3072:LtyLn9udlz6IqpIVIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//GQoy2zb/q:cD9DkCyF5qdhX11oG
MD5:	69B8B51CA26D07C798B8216F51E8E8C9
SHA1:	A50995B86475799A32CCF48BA92DD736F4175731
SHA-256:	D0EE25A5A7DEE8337B9DD12E65A5910E75C09AED36EB3ADE0907DE6E14A6D760
SHA-512:	5BE0C2C91FCD5FB4C45DDC57FA2E07A40EAFCBC9E1EABD29E59AF33B147CAD5A7FFECF4C1E9C05B0282C01939BEC11B13656A8CB299CE286188E2281F7B08E05
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.'...l.2...n.:...o.?...p.L...q.R...r.^...s.....t.....v.....w.....y.,...z.Z...\|.....}.........................................................................6.....[....................... ...........@.....3...........w.......................n.................5 ..... ..... .....!....."....f"....."....F#.....#....0$....P$....3%.....%....N&.....&.....'.....(....)....l)....B.....+.....+.....+.....,....i-.....-.........../.....0.....0.....0.....1.....2.....3.....3....o4.....5....D5....k5....$6.....6.....7....A7.....7.....8.....8.....8.....9....q:.....:.....;.....;....z<.....<.....<.....=....Q>.....>.....>....e?.....@....l@.....@....>A.....A....IB....hB....{C.....D....0E....fE.....F.....F....&G....OG.....G....TH.....H.....H....UI....6J.....J.....J.....K.....L....HM.....M....mN.....O....PO.....O....eP....+Q.....Q.....Q.....R....xS.....T....:T....aU.....V....\W....}W.....X....}Y.....Z....dZ....P[.....\.....\.....\.....]....G^.....^.....^....._.....`....ra

C:\Users\user\AppData\Local\Programs\Pralevia\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	769462
Entropy (8bit):	4.62458091701859
Encrypted:	false
SSDEEP:	12288:i2MtD9IESdhVzCDFVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONn:i2MF935J+f
MD5:	3EE6AECC3E7FAAB761EE57F73852BC2A
SHA1:	32374D3E543A57FB7E883B73522314D1958F3401
SHA-256:	F9E4F3E50D86F0C6FD271CAA160675E224ADB56A292BF21283733E2066A09995
SHA-512:	298FFC69605C0BF9BD809FA3DDA05769C78EEDE7E39934D8DB71C2362CAB07FE361F21DE9AB6696CEA38399E3F44819EC5A9559151EADE82D65A254BE8E90270
Malicious:	false
Preview:	........v(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....\|.8...}.i...........................................................................................................&.....H...........F.................]...........P.....p...........x.................n...........-.....>...........!.....P.....r...........m.................t ..... ....B!....f!.....".....".....".....".....#.....#....;$....R$.....$....W%.....%.....%....z&.....'.....'.....'....0(.....(.....(.....(....k).....)...............*....:+.....+.....+....$,.....,.....,.....,....l-.....-.... .....5............/....V/....g/...../....O0.....0.....0.....1.....1.....1.....1....z2.....3....R3....q3.....3....Y4.....4.....4....#5.....5.....5.....5....\6.....6.....7....47.....7....G8.....8.....8....<9.....9.....9.....9....P:.....:.....:.....:.....;.....<....b<.....<....Z=.....>.....>.....>....V?.....?.....@....N@.....@....~A.....A.....A....uB.....B.....C....1C.....C....tD.....D

C:\Users\user\AppData\Local\Programs\Pralevia\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1316123
Entropy (8bit):	4.299061147036261
Encrypted:	false
SSDEEP:	3072:69+sMSOGLEyMJLtS4Ba0cVk0G9V/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhss:6RMTEvMJg4Ba0c60oXp5CKMhqQ
MD5:	FA5F71CA9C17172D374D0A2FCFE907EB
SHA1:	23ABF6F3EAD1559632CAA31EE351193EF6CB7983
SHA-256:	F73CCAC3DEBBA20FB225209805FF2383609853111F931E6B82095C1EB56A6CE4
SHA-512:	06D990747EDED7AA09CE13107E44FBDDE17E60031191564D51D7E15C6DCC2ED411DD31ED5B343052757FA99CE2969321C61733CFD28C4309F3DB97AE4C8E2C87
Malicious:	false
Preview:	........_(..e.\|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....\|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....)...............+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

C:\Users\user\AppData\Local\Programs\Pralevia\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	594995
Entropy (8bit):	5.5192376579765945
Encrypted:	false
SSDEEP:	6144:I44gmOy0YXl+Qv6QyTRw6chThwl57v9YMrbLPDK:IZcucQSFRw6khS5BYAzK
MD5:	51B515FBC314CE3C9BAD9C4E64380B7C
SHA1:	46FFD2D0F72EB74066139EDB79AA9AD55EDEF6DD
SHA-256:	3CA8E7EB09AA20845684BEEFA2351AFD4C6CA95BC09BA8BD7A0B629FE8A40565
SHA-512:	97F23DB01D5517F5F2DD49BF3D8479EA2F7825A0684FBCF1DECEE49A136CFC0E933F1DD04D2B21EDF2E4A2200EC4A663C38E42E43FA2C1557E709AC010EC8B74
Malicious:	false
Preview:	.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....\|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H...................,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

C:\Users\user\AppData\Local\Programs\Pralevia\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	640919
Entropy (8bit):	5.644944304253967
Encrypted:	false
SSDEEP:	6144:oeo/GHgmRXxh1Rd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBBHAZd5kt8Ex9y+O5LG9b
MD5:	85D8BD3516B1965B153236D86B9BCCBC
SHA1:	996FA6AE823E72E811311C7F4F4FE76CCE686DD6
SHA-256:	EC81AC981AF0E962654AD4F65030064A6369DC2316CB1B10BB24B473808AD1E9
SHA-512:	ECAA5210DE1B3E389E5C728FEAD4538DEAE129339F3AA577AEB231E5FDB6C6615C11FE345753559FF491E63F80EB8390893A3576F3061979CE513A8193C3595E
Malicious:	false
Preview:	........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....\|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....\| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....)...............*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

C:\Users\user\AppData\Local\Programs\Pralevia\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	529374
Entropy (8bit):	5.380231602674279
Encrypted:	false
SSDEEP:	6144:MB0vgN7NxNRHOKd/+tQqDHcyef+eVnjHF/TmiZAWO5ABpIOBhUnNiT8kLHp:MB0mnJ/qYy2VnjHFbm8At5ABp9p
MD5:	7F8ABC55705A2E2561B2B2BB3068F361
SHA1:	4F1E68732EFC7E3F0F6E01B9E2093C0370BA4955
SHA-256:	84A9B61E27EDDA9B2998E8C57E5E81BC0C0D47D6988BD3B03959487D2FFF4921
SHA-512:	865B7571551E029B066E5DB9519AAFFD0A611644B860CB249D4344482B2FFD9CA5454B83C5150A9B89D1D8D270E304D848C8A6285F136FDEDAA3FC6F54CBC0CC
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...\|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).........T....s..........*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

C:\Users\user\AppData\Local\Programs\Pralevia\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	581023
Entropy (8bit):	5.296336796740395
Encrypted:	false
SSDEEP:	6144:Mi/nBHNmhXUerU9ZTx994eN7NgvESIqRRxsO1ytBvWjRT9Tj+rhazYDxrvAqpzSd:Mi/B+fbXlZm128uJekfXEpe5kLISg
MD5:	C1B0DCD5078858E58B6BB2DBD387B713
SHA1:	291EFF6C34726FD1D5FF950DE3C55FCDC6B211CC
SHA-256:	73CD1E113EBA841C26E67EA9431B885F7C51FE85D61862B1A766E185ACCB3E20
SHA-512:	2923967C21594D4A67C5C66E6F380BB4045271A2BB94F02221E63ADAF2E352E2C421D7BFD2832C2A5F85C6BEAD89F30DD22E0A1E2F01AE7BBA0E2EA0D6624ABC
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.\|...t.....v.....w.....y.....z.I...\|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-....[....d..........+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	708092
Entropy (8bit):	5.7122012433428555
Encrypted:	false
SSDEEP:	6144:SCG5Mw7ENPvE7v5DD79ZgQ21XymbA5zFLbbvVt:SrSw7ENPvE7F9ZgQ21Xi5zFLbj
MD5:	6D6909EB9E119554810EC30769475367
SHA1:	F54BF21A6DF4CD16EBC4460697F29C6B0406CCE0
SHA-256:	1DD20F7BD91426229BFB131B575E8154B21E623E3DB0162AEC26DC67E568584A
SHA-512:	73F32BC9F0FC9CC4C0B06EAC9F4EAFC8B2FDF424BCAC1EC8EC1E78C592C9302F847FCD3C15E52B15150CE8FF48AAE503B048F8819062DF1A2542A64DD528C9C3
Malicious:	false
Preview:	.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....\|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................\|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... ....D.........I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....\|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

C:\Users\user\AppData\Local\Programs\Pralevia\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1423990
Entropy (8bit):	4.241459783206421
Encrypted:	false
SSDEEP:	12288:X3jl6ezb4OpsJHVLl6S9Ab745LmWA4hqSm2Z:kbd5qWj
MD5:	E0263DF94950F8D42A2AB5E966B9FCC6
SHA1:	6081B840C5925212C3E298A4D4423138FAEA117D
SHA-256:	87EE47C4CEC984A995A53CE2EF212539B7ADEE4A9011775B8699A29164E53C5C
SHA-512:	35F020B541654B3CA776C1151A542CB8F2DCBF565693C313DA654708CB502FFE8454E8EC90575FBA54081E9B33B4E11D3272E49B37BFAE5B76F8C58D8E09A758
Malicious:	false
Preview:	.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....\|.....}............/.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t.........5,....D-..........\|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....\....\|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	599179
Entropy (8bit):	6.077511853083732
Encrypted:	false
SSDEEP:	12288:TwAD0v1A/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULZK5:Tg75vKLCWj
MD5:	136EEC6FCC52D9320760B395CE88BCE2
SHA1:	1E5390AAF2D771767C955CA141E75F650547603B
SHA-256:	1AF8AEAC229711E127844A71CABCAFB29FC752D3D8401F42CD120FCE3084744B
SHA-512:	95F4D062771250F883DD6D42128BD53392BA5390F695A868D11F626688727466DDBEC992EE391006779CD56F6116EDD88E37CE06DDE878D3DCECDA188599EFDC
Malicious:	false
Preview:	.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...\|.\|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....)........./...............*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....\|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

C:\Users\user\AppData\Local\Programs\Pralevia\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	644262
Entropy (8bit):	5.63564977677677
Encrypted:	false
SSDEEP:	12288:kjFt+07S0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0JMnrLZ5sjIjqN
MD5:	F17350067D1481437BB09810F7DF062E
SHA1:	B2FADFF14A973EA17A8B1B9462AC989059E05BA4
SHA-256:	B31B65E81DB7F1F3DAFFAC67B6436039EAD2545F02C428E60AB755AA2630285F
SHA-512:	B1463705E672B54CD9DEA76756AE3357C1750D9E2FDAD0DFA1799C896417637557F0269F830DAD73C4BE4CEE3564A4021D70BD692345EBACDC6DD9733DF46A8D
Malicious:	false
Preview:	.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...\|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....\|(.....(....h).....).....)....(...................m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....\|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....\|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

C:\Users\user\AppData\Local\Programs\Pralevia\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	643311
Entropy (8bit):	5.637264208534794
Encrypted:	false
SSDEEP:	6144:Uz9waCt7e5ov28mvsf4xN3tVF89voxEJiiLh/7bOEw5hp1UgFeTE/CoCKbnh2DeS:UbKvNMEpFOEw5pFeTunbf35S
MD5:	157D4757176A12671E1EAD17E4FC2C1E
SHA1:	BA783CBE4A80D91F5331CF8C39637530CAF3EE45
SHA-256:	614E634224D32E39E9A79679D915CE402A6D0106BEE37D39930884F9F6E3E01C
SHA-512:	FE55263345E043F9A1042B81DF6E5B04698DDF00B462AC51DFF7B3B6E73285315824D63E68A28B5CA236E211E6E04432153051E535315FE7CCD03D9848E02480
Malicious:	false
Preview:	.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....\|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....)...............*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1481376
Entropy (8bit):	4.274093209238161
Encrypted:	false
SSDEEP:	12288:gtUOGV+75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtu+mGKfhBP1zX23F3ek5V6jX9D3j
MD5:	8EF6F88631246B1B0EAC82E2D8329D20
SHA1:	346584AED03DD416FD4F81E3ED6C33004B5EFD35
SHA-256:	F003A5671D619E6ED42370E70D943EE276012246DFE99310366BC3A70484307A
SHA-512:	83CC553D2238B83170054D13FA3BDFBA400FA9D55F256F53529B89D69E0370E0C0F9A93AB0AC10592E0D8CC64A3B6F4BED9753E0440FDC0D35D79DC0F8C1733A
Malicious:	false
Preview:	.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....\|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

C:\Users\user\AppData\Local\Programs\Pralevia\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1222180
Entropy (8bit):	4.3006398765924665
Encrypted:	false
SSDEEP:	3072:gOG1c9CX6VI4rB1miMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznup6:fG0m4HwcasmKZKbzNvfq1E5imHRen
MD5:	7D2A82CE8F0F601CAC213B692484DB4D
SHA1:	FC90EC9C5E3CED11F0EA18EAAD949384B3CDB321
SHA-256:	0E65A4F22A6A52369F948526D5A3EE3C9BBC99AE23E0B2C414B376BA23C2D411
SHA-512:	BCE9B80A8AD088AF4D480E1BEAE9D8123CD7772EC0211041B8B537E18757E32EE6446005974596A92B2E7E1CF922D440A926C68C760D06326319107F538A7684
Malicious:	false
Preview:	........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....\|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....\|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....\|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	554824
Entropy (8bit):	5.250632390422656
Encrypted:	false
SSDEEP:	6144:1fZuPdEaPHfvDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HDsxd2hlWEG95vFG3
MD5:	9E6EAF18A4406ADF701388F8A1A43BB3
SHA1:	FA06D4903AD23D67B9B55A54E76B852D2091389E
SHA-256:	CE4B0390F707E3EC3BCBEFC11CB7B6B914AF50D89B950E16704DFB6D13F0FCA2
SHA-512:	F14C00AEED38C9ABD356805830279E64C35CAE07FD70C8D1B33F1F39A5E989785FE78B100E30629A74EEA2F208370B1EA1F6319351DF4A6E583E5F0C0B91E384
Malicious:	false
Preview:	.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....\|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... ....S....^.........A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

C:\Users\user\AppData\Local\Programs\Pralevia\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	537826
Entropy (8bit):	5.426161233716447
Encrypted:	false
SSDEEP:	12288:ruVkaF73k4oOp7fBpHXYbhOs5wk+bhPLgg5t:MkaRk01YbhOs5f+bFUG
MD5:	84BB0F7AEC428DC3D18AAA5D95D649F5
SHA1:	090A7A274F885C7A31C6872CA353000E6E7276B7
SHA-256:	697882AC2DA78894E449CB1F75DA43E7115C2481BBD2FEE3BDAA425E82FC232C
SHA-512:	5E92C748BB0B0F8E9605A5E851FE4441399D3CDF12192339C5ED6B707CC7D0B3D7A0131ADD9BAF7D7A83ABB895A415F93BF2472009BEC423D1ED6C59C3E7254B
Malicious:	false
Preview:	.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....\|.....}...............................#..........1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....)........._...................Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	556272
Entropy (8bit):	5.361684513866553
Encrypted:	false
SSDEEP:	12288:j8uP9HylbJ9WQusFUdFgN5tmjdx5btfmzaWDZqqn9pmTy:LPUlbJ9WQusFUu5tmjdx5bFmzaWVqqn1
MD5:	E0926ABE13AE64EE311D61621CFFBA0E
SHA1:	667307630E89F42838F8A644CCE5C4EE3745035F
SHA-256:	68D981BD2119D714FBC4BA22EA2D2A0B3D9E127DA7060D3BD02BD1FB5E895A43
SHA-512:	0BE1820EC3D592AF20F884FE9A9411209F5EEEDD656873C2304A3AE709C08CF5B724082810CFC9C7017248228400F4E55CBBB80592E51F897ADD2E44D6322BBC
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...\|.\|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....\|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)....]....l.........H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

C:\Users\user\AppData\Local\Programs\Pralevia\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	619274
Entropy (8bit):	5.77081171255827
Encrypted:	false
SSDEEP:	12288:ziKEE6WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UAMgmx1QhH1b5FuH4VZy:VmxnMJ1Qh15w
MD5:	2FA7348A1A79D06A0E19954504752A69
SHA1:	6C6108D36C9EC617E467A60D3025803E52ECB3AC
SHA-256:	2AB697892ED2186BDE0CFA3ED27857F850A73B195529F5A4F5A9658DE188EF6A
SHA-512:	3EE745FA39164AE8D08A531664D0F3D48B42BDF0A4E75542BA18F850AD2C087C7153592FDD588A0FCF9C3131320603441A3DE45170D5B12D64D8D39DB0C3C6C6
Malicious:	false
Preview:	.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...\|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J...................:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	581655
Entropy (8bit):	5.426555597307986
Encrypted:	false
SSDEEP:	6144:mHM4QhMCJisw0NBXBLGfs9y+z5GH8XuH0msRgMpI2:CchHiswI5tXIsR9pN
MD5:	FED7836F880F10063C82A7535904D132
SHA1:	6F7415BAE68CE0177505451684BF64F40DBE9D3F
SHA-256:	5A496E969E72EEBBD4D4757923C8C47F15CA3AFF2A5F9CD3147FF9FDF7F9BAA3
SHA-512:	F63F431416F73B1B570E1AC1E6067D5D64FD729BDBA49655C01F28A40FF36D2227CCDEF610B8BEEB52A0E9C911B7880304AE26C798D92C1E6846B46A3CF6F34D
Malicious:	false
Preview:	.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...\|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).........:....D..........*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

C:\Users\user\AppData\Local\Programs\Pralevia\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	585543
Entropy (8bit):	5.39898793200663
Encrypted:	false
SSDEEP:	6144:Edk/CJfjRJ97ieJVJJxhbHMm1wfBCV5z6jPdoSR7oF:6kQRM+V5+jPSSR7Y
MD5:	75A31E0FB6CD1D9725AC06A0AA3571F0
SHA1:	C72A670A4AD9AE358ACC58B6A0E9C0CEBE5260A9
SHA-256:	9EBAFB943BF20C66F8D9CA533633FDC63519E8AD38D78A3DD28B4457C38BA79D
SHA-512:	1AA5874CB6AD6DA85B3CD36787D6783F27A8F6A0A17B7BAE1E1FC1749B385D76CD899F95BA1B3900E80113D176B011E659B8ECC17E0A721DB2D357F7CF1FEBB1
Malicious:	false
Preview:	.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....\|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:....g....q..........+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....\|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	606335
Entropy (8bit):	5.454066659764432
Encrypted:	false
SSDEEP:	6144:kxrPki8XWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrSXWr3Nu9o7qHKasq5ezUuj/3f
MD5:	F9F4DBBF7EF8B266C557230667DA57DF
SHA1:	375B4CB7B9DECDF88D9604DEFD0EC2BB71976A44
SHA-256:	CB60090B451122165BB41ABC238318474C4E86A545EEF28AE2790C310C7D0050
SHA-512:	E667CB46FA9AD15ABEEC1FC30718BB21832233DAB257491827B70BC136162314ED5F51CE5DEBBDBA80AE7183114D297C3E5220D4824EFE4A33BAEA237DE63A1D
Malicious:	false
Preview:	.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...\|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).........C....S..........+....4+....H+.....+....@,.....,.....,.....,....G-....f-....\|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	996305
Entropy (8bit):	4.84516604439551
Encrypted:	false
SSDEEP:	12288:W+uapfQjRo4YS9PAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/o:WrU5H3O8
MD5:	0A6433F5A21736C5F764BD09125493BB
SHA1:	D6138D087BA165F5166E550578C33A8242753D3C
SHA-256:	53CED8C091B6745D06D6FE06EA3E9B6824256CD279A45C6ADE419BA1C9D547EF
SHA-512:	3D939F38BAA94D40A51B7056D81FC05C8180846F911768432E5044F235C5BED93F209ADFEB4BCE6E9E085FCA00EFCB7191EF1D22860FE48C7EC1FB6D4E2F0EC6
Malicious:	false
Preview:	.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...\|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....\|<.....=.....=.....=.....>.....?.....?.....?....\|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

C:\Users\user\AppData\Local\Programs\Pralevia\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	626605
Entropy (8bit):	5.81504518947247
Encrypted:	false
SSDEEP:	12288:6fK4vsktDh40i/igVQm5611wYZLtWTjsxt9Wl:6K8xjib5ewsPtIl
MD5:	4A1099074DDF127479370924850F9596
SHA1:	B638F9D506D05151148334A8C6A564F3B589349D
SHA-256:	2F09FF1B8F02F735511F1AC1ECAE5A3E88CD7FE16C58CEE38BEEA5ABA7FB83C9
SHA-512:	2F1BB9FC1AECD7ED5F3CA217A5BCD3482C699C785604492471E8EB8E2D233BEE3494224FA659A9FC7E7BAB5FBD9A235DB24A7B3E493B9E942DE28840560D1131
Malicious:	false
Preview:	.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.\|...\|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L...................X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

C:\Users\user\AppData\Local\Programs\Pralevia\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	601837
Entropy (8bit):	5.489526609579363
Encrypted:	false
SSDEEP:	12288:mZQlfcB2z/i1SE5vqfCWJU171i/fzSjqc:m+lBWSE5vqfmi/fzSl
MD5:	E1FE6B616D7C2149ED10303A0E1B2397
SHA1:	D115E509B608A11BD0F7CE7420803EFB19ACFC48
SHA-256:	70457F29ED3790557EF4C9792620C499A9E6134E004C5034586FADEF5A833F6B
SHA-512:	780567FFCA7C960A9A58E78B755F2CD334D4B1869C523621D8D36495E83BE77EBDBFB90FAA2FB99BF62544343D83DB1F618989425D6EDF4D8B8DC19DEBB70BDB
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...\|.\|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....\|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;....P.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

C:\Users\user\AppData\Local\Programs\Pralevia\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	924861
Entropy (8bit):	4.769818599739564
Encrypted:	false
SSDEEP:	12288:nP3ydDt2p7UinNLQIlApSld7vwFi4CBaAwN5YvTEquCxa4F37nyIzy/k/S:P3GwdfWX5suBr
MD5:	F18B138F89861ABA4E85DFA74CBE2EE7
SHA1:	A86C210AB3E972578CFF3755A1AD1DF9116D87DA
SHA-256:	7F3C729230EF2ED709C17BCDFF781EC4AA5921334CCEDDA148DF0027544094DD
SHA-512:	F4F80CCB74E49B0338B2D0B9DB7ADD3BF03B85B47119BB44A84697AA08A0081B4A6CB61FE970719268C3E9C6FB32A2CF21EC7C34EE12DEEB3A1D982B3485BB99
Malicious:	false
Preview:	.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....\| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... ....E....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

C:\Users\user\AppData\Local\Programs\Pralevia\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	541029
Entropy (8bit):	5.540056284180425
Encrypted:	false
SSDEEP:	6144:MnZyPzwENByftoSM1Q0Z4IooOVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgft:i8U2yfn0Z4+hJW5krMoMo
MD5:	7FBB29177D899C484CAB464442E57521
SHA1:	2E3A42786109D84FD2B8388E9ABB1EC4993477F3
SHA-256:	7FD305F5EC9AC220D6BA7EEFE49686EE02A574146AD023C99EA5C364780E79AB
SHA-512:	88738D0F652CC41C32E1018378252C8370BA9D9BFDBE5122380F9C1FC05BF6A437FFD3E562216F281D628294D9EEE74C4F10819EBFE7C2B6DE04EA2CA7DDB280
Malicious:	false
Preview:	........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....\|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).........C....S..........+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

C:\Users\user\AppData\Local\Programs\Pralevia\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	570564
Entropy (8bit):	5.341577353322297
Encrypted:	false
SSDEEP:	12288:EvzoOr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evkyv15zsI
MD5:	AF1FB718BFB3484F5DF40300B777E399
SHA1:	CCFB3F58A16388448BC9707E7E5CF79A6CF3A838
SHA-256:	434879A83079FBA562AF9DAC928AD2FCC1033E0A6A5A1F4822D36E710DECDD2B
SHA-512:	7666C6AEFCF9A7C266E3B2A0144CCD77448CE09D6B7FD2D863D9FF12689E393B5733B2DD577DB853A0775935F176CC1F6EA3E804B11DB14B831271AF4D6F0AEE
Malicious:	false
Preview:	.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...\|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................)......................P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X...............*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1468553
Entropy (8bit):	4.052667459747012
Encrypted:	false
SSDEEP:	3072:eO7hLhGq5MLs32+LCraKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+e2D1i554sRtRdutm1vYpiMy+
MD5:	7B03D2E9DCD91CAA8FCD7C38475EB1E0
SHA1:	6A4E53A3F995AFD5AF8B845850B2F100FB355281
SHA-256:	8C3E1B39555FD7852EEFDBF8E0D32843605E5B5C3B6770D573A89DBEC7CDEB85
SHA-512:	1883C030690E962833CBE5F7A68A870577D47EBE5018035153EDD365889722D0D4654BE384B6BE48CDFDD229D992C45B73304B1CA8333DDE212ABF15A2D3DE94
Malicious:	false
Preview:	........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....\|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....)........./....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h\|.....}....5~

C:\Users\user\AppData\Local\Programs\Pralevia\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1359278
Entropy (8bit):	4.3071107696404916
Encrypted:	false
SSDEEP:	12288:1/Tiy7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBc3p1FPntTitlF2iDk7Pgm:1/OI5RNH3y
MD5:	466338A39904D7758BAB24CFB55C61D4
SHA1:	1F147E8CCADD1E40A91752542B80CF59FA6A19E7
SHA-256:	513A1DB6CAA7F4E454DDC0CBA87494F5ADB754F437019696A991D228EBBBE945
SHA-512:	D6E935B1595D6EE595DB5B9C690F69F9DAAF44CBD9614716846ABF753726CFEEEE8415DEC41FF184D3F0CD17548F09696A2F832BEDF432DC7DA515E15C9CB28B
Malicious:	false
Preview:	.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.\|...z.....\|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'.........l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

C:\Users\user\AppData\Local\Programs\Pralevia\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	1142673
Entropy (8bit):	4.350579033495036
Encrypted:	false
SSDEEP:	12288:O80Z0XXN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w1Q:OP0a5ANf
MD5:	631EDF43BB77D016F4AE0BE9E979FFB5
SHA1:	597783295612E603917EA0B981105267CD902DA9
SHA-256:	6605217A533A0D0A9060DBD94AB3027762B21CB29C3BF1D2247CA4459D288BB9
SHA-512:	26F9150757FD6B863E837D1C83C9548B372EE05969999EF4316A538D1BACBE342E5CA908609ACAE1CB2C277314AEEE26567177470C11F4CC1A883C55E0FECA7E
Malicious:	false
Preview:	.........'..e.6...h.>...i.F...j.Q...k.`...l.f...o.n...p.{...q.....r.....s.....t.....v.....w.4...y.[...z.....\|.....}........................."........../.....7.....>.....E.....L.....N.....S.....w.................:.....K.....".......................^.............................f.......................[...........N............ ....< ..... ....X!.....!.....!.....".....#.....$.....$....w%.....&.....&.....&.....'....P(.....(.....(.....)....d...............+....r,.....,.....-....D.....3/...../....10.....1.....1.....1....62.....3.....3.....4....>4.....4.....5.....5.....6.....6.....7.....8....?8.....9.....9....2:....V:....";.....;....C<....j<.....=.....=.....>....->.....?.....?....#@....J@....dA....aB....%C....MC.....D.....D.....D.....E.....E....HF.....F.....F....fG.....G....MH....}H.....I....RJ.....J....XK.....K....mL.....L.....L.....M....:N.....N.....N.....O....IP.....P.....Q.....R.....R.....S.....S.....U.....V.....V...."W.....X.....X....FY....vY....,Z.....Z.....[....>[....G\.....].....]

C:\Users\user\AppData\Local\Programs\Pralevia\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	581275
Entropy (8bit):	5.614418811209825
Encrypted:	false
SSDEEP:	12288:A9d79N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:09Zb8kJ50Jy
MD5:	4B2AE4045996E28AA7DC340D8EE70672
SHA1:	B943EE6FB376DF266D8A0D0E8D6BACB337190DFB
SHA-256:	F2CA71FED0F1C1D8F081ADF740E5A04927890FF35DCCDE1FB2253479B927F93F
SHA-512:	5703645908EAFAB11503593F4A3B7F3BB278422F32608429CD98B28C5708D2656BF9042F41B3A70AFBD7DCD962A7CAB0476308ABAA987E395270CCF11BA64BA4
Malicious:	false
Preview:	.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....\|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....)........._...............*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

C:\Users\user\AppData\Local\Programs\Pralevia\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	996432
Entropy (8bit):	4.874097716523002
Encrypted:	false
SSDEEP:	12288:1xJLTABEpt2I9FGGHWY9TddsSr+whF5gZrZ+dIIXgOb5YB3Ijwl2Ab+rUcauHLNq:3RAypAI9tn75Brm
MD5:	7A639846A33339B486F485DF1706F3CA
SHA1:	ECCF7589474B7DA80CBA4670FEF45103B6770EF7
SHA-256:	843C206AD3FDD6A34D083AE3F969EF58BF3C087DCBA31AF6126FFE46B2726511
SHA-512:	32FE2D71233D300FA3054E631234194429A7C80BEA879F342EA4EE67B7BC514F697FA618DEB8ED456C0A9A099AF1D17811E621A359E66D4469229C95C8BFD39E
Malicious:	false
Preview:	........[(..e.t...h.\|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....\|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a..........*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ur.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	870809
Entropy (8bit):	5.161707757912529
Encrypted:	false
SSDEEP:	12288:wtiyilnG/Xo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:VyieKT5/Cgu
MD5:	E63B8CF9588245F579FCCB8DAE57DAA4
SHA1:	8638A0B0BCDFDC973B6491F9BDAAF2ECF9C6AC94
SHA-256:	1929F3C85E550CCCA9985CEF47BE30B690A701CBCA70345BAA0C2AAEE99809F6
SHA-512:	E7E3EF949B4917F929536F094884149E27D98A13D90A00D81F1FD0E2A67408839705BDD718E17DA6E1228DBE20D63746D7078CA15D2F59A8A37310F1972C04F6
Malicious:	false
Preview:	.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...\|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....)...............+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

C:\Users\user\AppData\Local\Programs\Pralevia\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	689418
Entropy (8bit):	5.790778266082849
Encrypted:	false
SSDEEP:	12288:32HxPY+cGZoEK9VaZLsFK0FnxBxJbTsIxvx5a8h/+cDNUOnmzi0HRva8Z1lc:1+cG6V4sE0RxHZH5a89+yiOnwi01a8ZE
MD5:	7E8B63AC1207CACA4892722737568983
SHA1:	81D8AAF528146B58E69635DB579FF62C9560C9E2
SHA-256:	590C7C9BCCEB61C96B24BCFBACC2B77B02A643E028C838ABBDAC7327A53D63B0
SHA-512:	5ECDA016A2CA9C4FB72BDF63CC145C580BB67489F1383AD51046E68B55E1FB39C0DDE084CA43080112CDA71F2847E9060FF2F5AB590365F08211DFC450B87468
Malicious:	false
Preview:	........Q(..e.`...h.h...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.O...w.{...y.....z.....\|.....}.(.....Q.....V.....^.....f.....n.....u.....\|...........................................................Q.................t...........I.....`.......................,...........-.......................A.....g.....s...........I.................4.................0............ .....!....0!.....!....A"....."....."....1#.....#.....#.....$.....$....=%.....%.....%....v&.....'....s'.....'.....(....q(.....(.....(....)).....).....).....)....D..........*.....+.....+.....+....G,....^,.....,....4-....k-....\|-.....-....F.....z.................S/...../...../.....0....x0.....0.....0....t1.....2....z2.....2.....3.....3.....3.....3....X4.....4.....4....a5.....5.....6....-6.....6....j7.....7....!8.....8.....9....:9....\9.....9....Y:.....:.....:....P;.....;.....<....-<.....<....u=.....=.....=.....>....[?.....?.....?....w@.....@.....A.....A.....A.....B....4B....HB.....B....zC.....C.....C

C:\Users\user\AppData\Local\Programs\Pralevia\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	496470
Entropy (8bit):	6.685833757509417
Encrypted:	false
SSDEEP:	6144:7Ol06NkCyyFF7puTIzL1EM7i56pz2dHy1t59/o3/4oT2Paq8lc:7OJNkc7puUzLe956pz2dH05xov4oTUV
MD5:	6F713D7BF5FE896F7BFB8F224D5E9FEF
SHA1:	6FB7C002CEE17130C7E429B446AB84C1029B2120
SHA-256:	A9D2FAA4ED07828E9939854A1AE09F3B42EAC956ABAA75AF66C37DD923B191C2
SHA-512:	0A692E643DD687F787F8681ADC6A4DD55D0CAC68B8CA640072CA5BDF897A816553F8FAE7D9AE674053051001BF0471A762807D6135E2D13C79052A7319E22619
Malicious:	false
Preview:	.........(W.e.....h.....i.....j.....k.'...l.....m.6...o.]...p.b...q.h...r.t...s.....t.....v.....w.....\|.B...}.s.........................................................................................!...........2.......................Q.......................X.......................a.......................`.......................+.....R....._.................2.....L...........'.....h.....z...........6.....j.....w.................E.....Q.................7.....I............ ....\ ....n ..... ..... .....!....1!....{!.....!.....!.....!....@".....".....".....".....#.....#.....#.....#....%$....w$.....$.....$.....%....]%.....%.....%.....%....;&....c&....o&.....&.....'....='....I'.....'..../(....p(.....(.....(.....)....?)....S).....).....).... ....7...............+....$+.....+.....+.....,....%,....q,.....,.....,.....,....A-.....-.....-.....-....A.......................]/...../.....0....(0.....0.....0....,1....A1.....1.....1.....2....&2....r2.....2.....2.....2....D3.....3.....3.....3....@4

C:\Users\user\AppData\Local\Programs\Pralevia\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	491014
Entropy (8bit):	6.696497754978831
Encrypted:	false
SSDEEP:	6144:IpP3cuA6WNemy5JSFW2uHu4u0cU52UznMi4LnKeze9Tk:qNWgmfWzu0cU52UznUeC
MD5:	71FB2E4270D6F3A1F04669E019F33764
SHA1:	E9F6ED29AF9DAF900431480CB8A17A1EE852459D
SHA-256:	965A32F56CAABAD66615659A0D79E0A4EB7A60C6E5CD8DC784FD7A1F95E80A0D
SHA-512:	39B7434DCAB722BFB14387F477990DDB2E13113F2065A047B5249DC075E98775D1868CEE30032C612B5AFF1B5BDC05192BC859F2C11E3E9CB89E4E694CE60322
Malicious:	false
Preview:	.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....\|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3....d...............+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....\|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

C:\Users\user\AppData\Local\Programs\Pralevia\resources.pak

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	5754374
Entropy (8bit):	7.996239716591597
Encrypted:	true
SSDEEP:	98304:QGZOyi6+Ykrht455GGPeenn0KJ00LEpxIvMi8rwrGU3nAabpdkmYAzFKwR4:QsnilYkrP455GGHnZEXU8kr1Xddf1FvG
MD5:	22729A6F12BFF0FEC1F416B52291E22C
SHA1:	851E4F5BD748F8E7F726314F9DF6FBCFE797D7BD
SHA-256:	E52FF4895AA4E1DC82462CDEEB0BCB1D89FC481BF82E8C604D0D0BD383AC3EC8
SHA-512:	DA88F1EF938F87AD8ADE5C71DF828521C06C5057A020C6AFF4074DBE33DDF72E2EF79F36D1CF92807796D8E0F4093BBB1676225E28155A9E02A55F27CF664DA4
Malicious:	false
Preview:	............f..#..{.D...\|..1..~..4....'G....9I.........r...............................................j................D.....DC....D.....D.....Dk....Dt....D.....D. ...D.$...D.$..HE.$..IE.(..JEX..SE./..TE.8..UE.G..VE.h..\E.q..]E.r..^Els..`E.t..aERy..bE....cEVo..dE.Y..eE.Z...E.\...E.m...EFo...EVs...E.u...E.{...E.....E.....E.....E....E9....E.....E4....Em....E.....E.....E.....Eb....E.....Ea....L.....L.....L....+Le...,L....-Lr....Li%../L)0...Q.@...Q)M...Q.U...Q-Y...Q.\...Q.f...Q.g...Q.i...Q~j...Q.....Q.....R;....R...Zd~"..[d_$..\dw9..]dD<..^d.=.._dp@..`dBC..ad.E...d.P...d.U...dZ[...d.i...d.l...d.q...d8s...d.t...d9v...d.y...dx~...d...6e....7e....8e....9et...:e....;e\...<e....=e....>eb...?e....@e....AeI...Be\|...Ce.....g.....g.,...gT....../....03....Q&.....'........../.....0.....5....NH..........7.................x.......................v... .}...<..H..=..J..>.NO..?..T..@..V..B..c..C. f..D..o..E..s..F..s..G.....H.m...I....J.B...K.....L.X...M.B...N.....O.....P.....Q.....R.[...S.....U...

C:\Users\user\AppData\Local\Programs\Pralevia\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	53665281
Entropy (8bit):	6.100360809054309
Encrypted:	false
SSDEEP:	196608:6WUWbSmDsWQkfOOXsW59ehx6+oPg0J3K4SJ3VSPQyrmAv/zANtP6ChuVZ:0LjOc0yToPg0JjbmAzANtP6ChuVZ
MD5:	1A6450015D377E52E635B5ECD4E0F08A
SHA1:	DDA8C3307E149FE557B189833BECFA3ADEFABC75
SHA-256:	F150225BD9C91D5D770476E77CBDE480FCA374CB62827C731BA15A588E6EE5FA
SHA-512:	6DFEA34A17D215B95A99D68291D4CE082B8C5EFF4E7C59C542FDFD576F2FFE91CBB1B9C423ABF430D08560DBFE47CA7C9F342DF3F04B0BDB31BF5959A9F57ED3
Malicious:	false
Preview:	....L0..H0..A0..{"files":{"app.js":{"size":36823,"offset":"0"},"package.json":{"size":448,"offset":"36823"},"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"offset":"37271"},"index.mjs":{"size":299,"offset":"38002"},"package.json":{"size":1427,"offset":"38301"},"build":{"files":{"index.cjs":{"size":10398,"offset":"39728"},"index.d.cts":{"size":1050,"offset":"50126"},"lib":{"files":{"index.js":{"size":10100,"offset":"51176"}}}}},"node_modules":{"files":{"emoji-regex":{"files":{"LICENSE-MIT.txt":{"size":1077,"offset":"53492083"},"RGI_Emoji.js":{"size":12976,"offset":"53493160"},"index.js":{"size":15735,"offset":"53506136"},"package.json":{"size":889,"offset":"53521871"},"text.js":{"size":14468,"offset":"53522760"},"es2015":{"files":{"RGI_Emoji.js":{"size":14024,"offset":"53537228"},"index.js":{"size":17405,"offset":"53551252"},"text.js":{"size":15796,"offset":"53568657"}}}}},"string-width":{"files":{"index.js":{"size":1064,"offset":"53584453"},"li

C:\Users\user\AppData\Local\Programs\Pralevia\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	316538
Entropy (8bit):	4.177187598746768
Encrypted:	false
SSDEEP:	3072:5+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:5efPciePmMXh1aOCsy3hpFRlzVw
MD5:	6AFB38479A96EE960ED64FC0CAA0401B
SHA1:	01FF59215DFDFDB41A38634EE8115AAAF89553F5
SHA-256:	769785EDA3922BD210EE776FA46E97E30217755CA1DBB928230542BDA2786857
SHA-512:	4DDEBD9B337CB857835696E4579DB0E735CB0E4CCC454EF851B940710CAD2CE77CC55AD0D7C44D55E532D131D35317060ADDC7975F9DA7D33D9165038FE143EB
Malicious:	false
Preview:	............._.13.0.245.19-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	687473
Entropy (8bit):	5.155450487344642
Encrypted:	false
SSDEEP:	6144:XPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:XPY5nnbe3WZBr/iXo73nVE+2l
MD5:	C7C05A84743ECDCE85B273166D1E933D
SHA1:	7F550B7ED0D4202F6E126A6D4615766998425437
SHA-256:	30F46B08A76755B48E569AFFF2657CD14734508A0D48DD053462D8C95604BC52
SHA-512:	C43FCBF0CE71BB6144DD56A9BFD25341E60D0EADACEE21A662D578CE40D79D8D9E377DFD5DE3AF2E33268041A5C665DC803D282243A145CAE22600D77B6DE5EB
Malicious:	false
Preview:	............na.13.0.245.19-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5532672
Entropy (8bit):	6.341680053249589
Encrypted:	false
SSDEEP:	49152:zun45w3vf22YlLzv3S1Lkc+httkltRx/FU5f/GeQZImSUzRTNaJmAvFOC8pefqql:0P3vfJGXKT8FIjU7s
MD5:	E165350675C58A0C27AC73DDC852292F
SHA1:	6103EB6D27653238A12B56F092937C58DECB1894
SHA-256:	9FFB78591FDF2D24F8E7290DC95B98BD16EB59192D9ECEC9D656C46164C27E22
SHA-512:	972B228A1AD7AA5CD3CCD3E4D1A18489D06B1C2F5D6AD742DF250934406281A699717FEE38C22902B0D59BDFA2F1BBAAA9BECE3BA41292E9D45F7E3354C95D85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........." ......B...........;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text.....B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...TR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Pralevia\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Programs\Pralevia\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	894976
Entropy (8bit):	6.605196606058236
Encrypted:	false
SSDEEP:	24576:SuZ8ZzBN4kClmtVeEj3GxG6Z5WjDYsHy6g3P0zAk7TOwh2:SuZQnDOmtVeErG86Z5WjDYsHy6g3P0zJ
MD5:	18FF150ADB11324A4F3219AAC9A7349B
SHA1:	88150D7716D9E1ACAF3814EA660F24DA1EE70032
SHA-256:	7F6739A3A7F91E817DC5C6F25EC1E04CC453FA2E2C3AE676B198CDE76E1FCF01
SHA-512:	536490DA0C33AAA26D8B2879EC815A7135F172257F0708DD039042AA309CAF129851C12BD01AE8DF25ED379ECA43D22C150CFABC025FA9F9342AFA871DA7539B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....XGg.........." ................0~.......................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18ab4b65-60db-48a2-badd-b493a695faed.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1622528
Entropy (8bit):	6.538502451577764
Encrypted:	false
SSDEEP:	24576:ArAGsbOqiI929Q4huHzDrbWGt7i/ueKGNOccHeG7gzSeWBedaO9VJMU4exs9nHz:AnKE9uHzDs/ugOcc+QFBVQM
MD5:	9C138D812BDADBB0162EC4567573A65E
SHA1:	67DD71115C91F601C38747147B67EA6B33A1CD51
SHA-256:	EFAB32CE7C07BF5F4353C4AE3ABC35C7077FAFB1EEA2B091D073118770ACF264
SHA-512:	4E7FEABCA4AB4C40C4862CA8DEDD6BF68E11F3E4392CA11186FE1683B0165CC10AAE981377459A9E416DEB7F0D8A242D9709554DA626B90A82D9F37DD8306384
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............x...x...x...\|..x...{..x...}.S.x...\|..x...{..x...}..x...y..x...y...x.`.q..x.`.x...x.`....x.`.z...x.Rich..x.........PE..d.....\g.........." .........<......p.....................................................`..........................................p.......p..(.......................................p...........................@.......................,e..@....................text.............................. ..`.rdata..............................@..@.data....e.......N...l..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\877ede74-e647-4d0b-97e0-a1e983d2bc5c.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.055411992765344
Encrypted:	false
SSDEEP:	3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
MD5:	04BFBFEC8DB966420FE4C7B85EBB506A
SHA1:	939BB742A354A92E1DCD3661A62D69E48030A335
SHA-256:	DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
SHA-512:	4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\SpiderBanner.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.5347224014600345
Encrypted:	false
SSDEEP:	192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5:	17309E33B596BA3A5693B4D3E85CF8D7
SHA1:	7D361836CF53DF42021C7F2B148AEC9458818C01
SHA-256:	996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
SHA-512:	1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\WinShell.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	3.3907428713435226
Encrypted:	false
SSDEEP:	24:eFGSizG71F+wwBhckFZEdnNLYFI6StBy1FMG/N9+ChRXZ76l/bkJZksWVtfa:iiGv+wwBh/+l42pcp7+jkJ2vTfa
MD5:	1CC7C37B7E0C8CD8BF04B6CC283E1E56
SHA1:	0B9519763BE6625BD5ABCE175DCC59C96D100D4C
SHA-256:	9BE85B986EA66A6997DDE658ABE82B3147ED2A1A3DCB784BB5176F41D22815A6
SHA-512:	7ACF7F8E68AA6066B59CA9F2AE2E67997E6B347BC08EB788D2A119B3295C844B5B9606757168E8D2FBD61C2CDA367BF80E9E48C9A52C28D5A7A00464BFD2048F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................[........[....[....[...Rich..........PE..L.....1T.........."!......................... ...............................0..................................................<............................ ..4....................................................................................text...B........................... ..`.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	92896398
Entropy (8bit):	7.999996085647525
Encrypted:	true
SSDEEP:	1572864:ZWT8soyKdotoik0TWPb1SI91uMvSdxsA1+YVgt:UDIniZABN9cESLsA1+H
MD5:	A534221A7D9818C8EF169E8B4E7C792E
SHA1:	9D3FA0DAF579B6218EEFD12E7DADBA8D25E6CAF3
SHA-256:	93C7CD33D113E045E5879B366D275C75D27B57EB4E08F986E86CCB7997E20525
SHA-512:	3AE030DDAEAF20A3105C9E8F4C993BC79E0BF0FAED9EC50D95AE47BD60A432DF1ADC012D447C21596CA48A9AE08ACCD13C8A68E28BEEA72B9B9649F301DE232C
Malicious:	false
Preview:	7z..'....-.I\|......%.......U6._....]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!Q..X,s..T...>~(\|.s..%...1`.Yw......vK.Tz.\|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..G.a...Z...(....R..R8\|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...\|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.\|r.{.a\|^.]..Kn..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN\|....2m.A.{..m..y).B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.\|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{..........Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:	96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\pralevia-updater\installer.exe

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	93419212
Entropy (8bit):	7.999986450954934
Encrypted:	true
SSDEEP:	1572864:ZRWT8soyKdotoik0TWPb1SI91uMvSdxsA1+YVg8:ZsDIniZABN9cESLsA1+y
MD5:	460FEB84C01602F95E4314AD2DDB601C
SHA1:	01867F8362F5710D61A0E53169F0165C93FFD164
SHA-256:	4CC3FA8AAEC18A08FDF93E25CB1B22BBABC79B8A85A50DDEDBBC33ED67B2C7BF
SHA-512:	5072888BED6C10E85917BB1B76D5A8566A10FE1D021169A065C50B1C048194172E8DB66C32E6730BBB73C606D766D836684C6297749D75B26FA387DAB7A93CE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.......................................@.............................................H............................................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...@...............................rsrc...H...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\pralevia-updater\installer.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pralevia.lnk

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Jan 3 17:41:09 2025, mtime=Fri Jan 3 17:41:14 2025, atime=Fri Dec 13 19:11:36 2024, length=188851200, window=hide
Category:	dropped
Size (bytes):	2293
Entropy (8bit):	3.765602585315746
Encrypted:	false
SSDEEP:	24:8ZZdHRy6WMKRJJuxr50A7fAe7HAGr/Z9Gro9Gr/tO4ZAKqGr/89pJqykeKhbm:8ndHRHQRJJ0LpgG99GE9GJZRqGyqykJ
MD5:	EAB3F65A46FD737BB72A7682D447CBE3
SHA1:	1E198634A0AE941FBDA6243AE74A9F2043AA4640
SHA-256:	00143FF9844B9FE47F653E092D2FEE021C2C0B3EBFE54C8634D967415C8CEA58
SHA-512:	CEEFCDB3B89F365BCCCF0F0EF2A46EC02F8672D55281939BB8295FD22679D46E042BC15987D86DE1475C5C267C043E9CE230E9ECB4D091468F41D8C12528B537
Malicious:	false
Preview:	L..................F.@.. ...H+%..^......^...L.6.M....A.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v.....w...^.......^......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^#Z.............................%..A.p.p.D.a.t.a...B.P.1.....#Z...Local.<......CW.^#Z.....b.....................2.q.L.o.c.a.l.....Z.1.....#Z....Programs..B......#Z..#Z.............................v..P.r.o.g.r.a.m.s.....Z.1.....#Z...Pralevia..B......#Z!.#Z..............................P.r.a.l.e.v.i.a.....f.2...A..Yr. .Pralevia.exe..J......#Z%.#Z(...............................P.r.a.l.e.v.i.a...e.x.e.......j...............-.......i.............ca.....C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe....m.a.n.a.g.e.m.e.n.t...3.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.P.r.a.l.e.v.i.a.\.P.r.a.l.e.v.i.a...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.P.r.a.l.e.v.i.a.;.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.

C:\Users\user\AppData\Roaming\Pralevia\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.558527536465038
Encrypted:	false
SSDEEP:	12:YKWSCuj9rrt+cGVw6ikC0Y0amZL66I6fsuh8ckL:YKWJu5rrtcVjCH0a9Sfsu1e
MD5:	B495694B4DBB7C4D2933BA5993C12279
SHA1:	D158B36BCBBA2C70E8304941929A15E0C3AFDB6E
SHA-256:	AC8D2EBBA2387E36E7F91F15EAF7D9AF4097F64FC7C81544684C8023A315BE80
SHA-512:	99D066782019115B10D48874CF3341BCF37BA5AD6A0F4E8635E4C5D6C65AA0755C748D6F2807F94D621AD43223D994E4F8CDA46CFC0A5C661B6987BABEF08607
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAP11WfpLY5RZwt+OzPVf6mEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAA7BdxVfV10dWpldOMAKhpydsrJfQ3zaVZK0cCHuEMwwgAAAAAOgAAAAAIAACAAAAAb6zjZGB6CQoPyIfNvFRRLw+8ate6dReMNCzPv1bCQCTAAAABxhvw63UCB0XBUwg+Zc0nnejgLKfa3DRyShUb1PKDcuUw32gyUGSS2yO2AuaTcR0tAAAAArHEQtmdsdA+PuFwtqpFbITCt6ck+QbdsZuCGQvuCozFmqj+CLGfgw0JSsLBa671AQ6V9JXtGUf0QZrd8slZ4BA=="}}

C:\Users\user\AppData\Roaming\Pralevia\baaf4511-bad6-4b02-a3de-c5f1b46eeec2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	JSON data
Category:	modified
Size (bytes):	434
Entropy (8bit):	5.558527536465038
Encrypted:	false
SSDEEP:	12:YKWSCuj9rrt+cGVw6ikC0Y0amZL66I6fsuh8ckL:YKWJu5rrtcVjCH0a9Sfsu1e
MD5:	B495694B4DBB7C4D2933BA5993C12279
SHA1:	D158B36BCBBA2C70E8304941929A15E0C3AFDB6E
SHA-256:	AC8D2EBBA2387E36E7F91F15EAF7D9AF4097F64FC7C81544684C8023A315BE80
SHA-512:	99D066782019115B10D48874CF3341BCF37BA5AD6A0F4E8635E4C5D6C65AA0755C748D6F2807F94D621AD43223D994E4F8CDA46CFC0A5C661B6987BABEF08607
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAP11WfpLY5RZwt+OzPVf6mEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAA7BdxVfV10dWpldOMAKhpydsrJfQ3zaVZK0cCHuEMwwgAAAAAOgAAAAAIAACAAAAAb6zjZGB6CQoPyIfNvFRRLw+8ate6dReMNCzPv1bCQCTAAAABxhvw63UCB0XBUwg+Zc0nnejgLKfa3DRyShUb1PKDcuUw32gyUGSS2yO2AuaTcR0tAAAAArHEQtmdsdA+PuFwtqpFbITCt6ck+QbdsZuCGQvuCozFmqj+CLGfgw0JSsLBa671AQ6V9JXtGUf0QZrd8slZ4BA=="}}

C:\Users\user\Desktop\Pralevia.lnk

Download File

Process:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Jan 3 17:41:09 2025, mtime=Fri Jan 3 17:41:23 2025, atime=Fri Dec 13 19:11:36 2024, length=188851200, window=hide
Category:	modified
Size (bytes):	2285
Entropy (8bit):	3.7659259121562605
Encrypted:	false
SSDEEP:	24:8ldHRy6WMKR1EuQsr50A7fAe7h/Gr/Z9Gro9Gr/tO4ZAKqGr/89pJqykeKhbm:8ldHRHQR1/PLppG99GE9GJZRqGyqykJ
MD5:	95D2EAA015E3B092B6F02FE47907F790
SHA1:	D6AE46E423C96F4ED691817440D9C5937EF7FEF6
SHA-256:	31830F259A03B63E34AE99C12B8EC31E4478768E7C2A20197BE8D5E3B3056D36
SHA-512:	F7B9E402FAE5A991A849C77C109878B7D4DF7FF8CB02B534700DA4D51E2B4229DEA9A5861041EEECADDDFC2CFB8347BE01CECF8878ABAFA96D03DBC14BD62788
Malicious:	false
Preview:	L..................F.@.. ...H+%..^..W....^...L.6.M....A.....................(.:..DG..Yr?.D..U..k0.&...&......vk.v.....w...^.......^......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^#Z.............................%..A.p.p.D.a.t.a...B.P.1.....#Z...Local.<......CW.^#Z.....b.....................2.q.L.o.c.a.l.....Z.1.....#Z!...Programs..B......#Z..#Z,...........................H...P.r.o.g.r.a.m.s.....Z.1.....#Z,...Pralevia..B......#Z!.#Z,............................5..P.r.a.l.e.v.i.a.....f.2...A..Yr. .Pralevia.exe..J......#Z%.#Z(...............................P.r.a.l.e.v.i.a...e.x.e.......j...............-.......i.............ca.....C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe....m.a.n.a.g.e.m.e.n.t.../.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.P.r.a.l.e.v.i.a.\.P.r.a.l.e.v.i.a...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.P.r.a.l.e.v.i.a.;.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.

\Device\Null

Download File

Process:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
File Type:	ASCII text, with very long lines (427)
Category:	dropped
Size (bytes):	872
Entropy (8bit):	4.935220725530676
Encrypted:	false
SSDEEP:	12:4iCa8YcryJ6SqzDtSXrfIteE/IGdrdmijN00L/WUu5QAmH+NcczIXoeZC+F:4sVcryJ4D6fojxdpm/E/xmQoNcckXoex
MD5:	7888B7A98269F3D5520E2DC484EEFFE8
SHA1:	755B43C132CFD540F8C592BC2EEC9F74BA030772
SHA-256:	355E260768F7A38BAB977F97AD647FAA890E1279A00229206F58F833F1C9DBE9
SHA-512:	2674B6F8FB5C3CE12BA15B34F542C1771FB1EBE0078A74F228206A232DA79F505DFA177173C7EAA8CE33C1A48B9A0F97FE0DAE51545FF88DD5328C882F3CA81F
Malicious:	false
Preview:	(node:7848) UnhandledPromiseRejectionWarning: TypeError: fetch failed. at node:internal/deps/undici/undici:13392:13. at process.processTicksAndRejections (node:internal/process/task_queues:95:5). at async eval (eval at <anonymous> (eval at <anonymous> (C:\Users\user\AppData\Local\Programs\Pralevia\resources\app.asar\app.js:1:36748)), <anonymous>:3:108527).(Use `Pralevia --trace-warnings ...` to show where the warning was created).(node:7848) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999986450954934
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Pralevia Setup 1.0.0.exe
File size:	93'419'212 bytes
MD5:	460feb84c01602f95e4314ad2ddb601c
SHA1:	01867f8362f5710d61a0e53169f0165c93ffd164
SHA256:	4cc3fa8aaec18a08fdf93e25cb1b22bbabc79b8a85a50ddedbbc33ed67b2c7bf
SHA512:	5072888bed6c10e85917bb1b76d5a8566a10fe1d021169a065c50b1c048194172e8db66c32e6730bbb73c606d766d836684c6297749d75b26fa387dab7a93ce5
SSDEEP:	1572864:ZRWT8soyKdotoik0TWPb1SI91uMvSdxsA1+YVg8:ZsDIniZABN9cESLsA1+y
TLSH:	042833B204F85933E678F0337FC2D23A97968A176B464CEE1589F91114BC616313F9AE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	131150d2cccc371f

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007F12A0D2DE53h
push ebx
call 00007F12A0D31105h
cmp eax, ebx
je 00007F12A0D2DE49h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F12A0D3107Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F12A0D2DE2Ch
push 0000000Ah
call 00007F12A0D310D8h
push 00000008h
call 00007F12A0D310D1h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007F12A0D310C5h
cmp eax, ebx
je 00007F12A0D2DE51h
push 0000001Eh
call eax
test eax, eax
je 00007F12A0D2DE49h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x9448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x9448	0x9600	040b0adf45d108aec14fab50717bc969	False	0.5107552083333333	data	6.196173213064641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f568	0x2cf5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9946998001563994
RT_ICON	0x1a2260	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m	English	United States	0.26566390041493776
RT_ICON	0x1a4808	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m	English	United States	0.3904784240150094
RT_ICON	0x1a58b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m	English	United States	0.4872950819672131
RT_ICON	0x1a6238	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m	English	United States	0.62677304964539
RT_DIALOG	0x1a66a0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1a68a8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1a69a0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1a6a90	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1a6c90	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1a6d80	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1a6e68	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1a7058	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1a7140	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1a7220	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1a7410	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1a74f8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1a75d8	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1a77d0	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1a78b8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1a7998	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1a7ba0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1a7c98	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1a7d88	0x4c	data	English	United States	0.7763157894736842
RT_VERSION	0x1a7dd8	0x248	data	English	United States	0.5
RT_MANIFEST	0x1a8020	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 19:41:29.962621927 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:29.962738037 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:29.962817907 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:29.963413954 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:29.963429928 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:30.420634031 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:30.421180010 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:30.421200037 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:30.422061920 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:30.422125101 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:30.424912930 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:30.424949884 CET	443	64903	34.117.59.81	192.168.2.4
Jan 3, 2025 19:41:30.425002098 CET	64903	443	192.168.2.4	34.117.59.81
Jan 3, 2025 19:41:30.889695883 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:30.889728069 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:30.889882088 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:30.890994072 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:30.891016960 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.424483061 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.424948931 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:31.424967051 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.425951958 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.426162958 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:31.426899910 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:31.426943064 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.427052021 CET	443	64906	199.59.243.228	192.168.2.4
Jan 3, 2025 19:41:31.427102089 CET	64906	443	192.168.2.4	199.59.243.228
Jan 3, 2025 19:41:31.427225113 CET	64906	443	192.168.2.4	199.59.243.228

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 19:41:28.957770109 CET	51179	53	192.168.2.4	1.1.1.1
Jan 3, 2025 19:41:29.913969994 CET	53	51179	1.1.1.1	192.168.2.4
Jan 3, 2025 19:41:30.431900024 CET	59254	53	192.168.2.4	1.1.1.1
Jan 3, 2025 19:41:30.885831118 CET	53	59254	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 19:41:28.957770109 CET	192.168.2.4	1.1.1.1	0x99ea	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jan 3, 2025 19:41:30.431900024 CET	192.168.2.4	1.1.1.1	0x6e4c	Standard query (0)	i7next.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 19:41:29.913969994 CET	1.1.1.1	192.168.2.4	0x99ea	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Jan 3, 2025 19:41:30.885831118 CET	1.1.1.1	192.168.2.4	0x6e4c	No error (0)	i7next.me	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 19:41:30.885831118 CET	1.1.1.1	192.168.2.4	0x6e4c	No error (0)	77980.bodis.com		199.59.243.228	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:40:57
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pralevia Setup 1.0.0.exe"
Imagebase:	0x400000
File size:	93'419'212 bytes
MD5 hash:	460FEB84C01602F95E4314AD2DDB601C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:41:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Pralevia.exe" \| find "Pralevia.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:41:00
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:41:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Pralevia.exe"
Imagebase:	0x3e0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:41:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "Pralevia.exe"
Imagebase:	0x440000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:41:26
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe"
Imagebase:	0x7ff7008a0000
File size:	188'851'200 bytes
MD5 hash:	195BD5803C03DDD47267FE9E8FB71430
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:41:29
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
Imagebase:	0x7ff7008a0000
File size:	188'851'200 bytes
MD5 hash:	195BD5803C03DDD47267FE9E8FB71430
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:41:30
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --field-trial-handle=2568,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
Imagebase:	0x7ff7008a0000
File size:	188'851'200 bytes
MD5 hash:	195BD5803C03DDD47267FE9E8FB71430
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:43:28
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Pralevia" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1116,i,4069595913750584292,9065053436439289284,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
Imagebase:	0x7ff7008a0000
File size:	188'851'200 bytes
MD5 hash:	195BD5803C03DDD47267FE9E8FB71430
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.2%
Total number of Nodes:	1333
Total number of Limit Nodes:	35

Executed Functions

Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

Error launching installer, xrefs: 004036BA
TEMP, xrefs: 00403617
~nsu, xrefs: 0040372F
\Temp, xrefs: 004035E9
SeShutdownPrivilege, xrefs: 00403859
TMP, xrefs: 0040361F
NSIS Error, xrefs: 00403451
Low, xrefs: 00403605
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
.tmp, xrefs: 0040374B

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-3195845224
Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNELBASE(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(?,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58

Function 004059CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004DF000,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(00460250,\*.*,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNELBASE(00460250,?,?,?,0040A014,?,00460250,?,?,004DF000,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: d24b36fde581ccc6802bb78d79f9b729ec530bf46928932bd36a11826cef9a2a
Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
Opcode Fuzzy Hash: d24b36fde581ccc6802bb78d79f9b729ec530bf46928932bd36a11826cef9a2a
Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E

Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
FindClose.KERNELBASE(00000000), ref: 00406614

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,00450248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E

Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,74DF3420,004CB000,00000000), ref: 00403A2B
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

RegisterClassW.USER32(00472E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
RegisterClassW.USER32(00472E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

Remove folder: , xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE
.DEFAULT\Control Panel\International, xrefs: 00403A16
RichEd32, xrefs: 00403BE6
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
RichEdit, xrefs: 00403C05
RichEdit20W, xrefs: 00403BF6, 00403BFC
RichEd20, xrefs: 00403BD8
_Nb, xrefs: 00403B2E, 00403B96
.exe, xrefs: 00403AB8

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-564491471
Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E

Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0042CE00,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0042CE00,Remove folder: ), ref: 0040647A
CoTaskMemFree.OLE32(0042CE00), ref: 00406485
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000), ref: 00406503

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\, xrefs: 00406301
Remove folder: , xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1428010240
Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E

Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Error launching installer, xrefs: 00402F2D
Inst, xrefs: 00402FC2
Null, xrefs: 00402FD4
soft, xrefs: 00402FCB

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: b6f6648de98c24fa7c04dbba87c1fded15afc009f9c9acd1abae5bab2567aa71
Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
Opcode Fuzzy Hash: b6f6648de98c24fa7c04dbba87c1fded15afc009f9c9acd1abae5bab2567aa71
Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

ExecShellAsUser, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp$C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll$ExecShellAsUser
API String ID: 1941528284-4188895
Opcode ID: ef34b70ba7e76013f08a8010c699c1fb49796a167d53f933b8375716ae072387
Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
Opcode Fuzzy Hash: ef34b70ba7e76013f08a8010c699c1fb49796a167d53f933b8375716ae072387
Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Strings

%s%S.dll, xrefs: 00406670
UXTHEME, xrefs: 0040662D
\, xrefs: 0040664C

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp
API String ID: 2655323295-1513021386
Opcode ID: 108721b550a48034b2014e23eab57ec1314cfbc5d5ef1d2255c6534627125d58
Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
Opcode Fuzzy Hash: 108721b550a48034b2014e23eab57ec1314cfbc5d5ef1d2255c6534627125d58
Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29

Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9

Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

lstrlenW.KERNEL32(00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405CF0
GetFileAttributesW.KERNELBASE(00464250,00464250,00464250,00464250,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00405D00

Strings

PBF, xrefs: 00405C9D

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: PBF
API String ID: 3248276644-3456974464
Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9), ref: 00405E18

Strings

nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(00888648), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

ExecShellAsUser, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Global$AllocFree
String ID: ExecShellAsUser
API String ID: 3394109436-869331269
Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D

Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,00464250,00405CE0,00464250,00464250,00000000,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420), ref: 00406608
Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614

lstrlenW.KERNEL32 ref: 00402299
lstrlenW.KERNEL32(00000000), ref: 004022A4
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59

Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,00464250,?,00405CAE,00464250,00464250,004DF000,?,74DF3420,004059EC,?,004DF000,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C

Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405405

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

CoUninitialize.COMBASE(00000404,00000000), ref: 00405451

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,004DF000,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14

Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09

Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19

Function 004038D0 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E

Non-executed Functions

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

, xrefs: 00405257
N, xrefs: 00404F29
M, xrefs: 00404E48

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58

Function 00404722 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

Remove folder: , xrefs: 00404883, 00404888, 00404893
A, xrefs: 00404845

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Remove folder:
API String ID: 2624150263-1936035403
Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 004072EC Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 004043F0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

Remove folder: , xrefs: 004045CD
gC@, xrefs: 004045FA
N, xrefs: 0040458C

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder: $gC@
API String ID: 3103080414-3559505530
Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

%ls=%ls, xrefs: 00405F7B
[Rename], xrefs: 00405FEF, 00406001

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD

Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,00000000,0042CE00,74DF23A0), ref: 0040537D
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\, xrefs: 00405343, 00405353, 00405359, 0040537C, 00405388

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\
API String ID: 2531174081-1789707395
Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E

Strings

MS Shell Dlg, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(059176C8,00000064,059176CC), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 119b9e301f9c75836b9179208c0dbdb6f02c12704b392f46658d181c58c9b0fc
Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
Opcode Fuzzy Hash: 119b9e301f9c75836b9179208c0dbdb6f02c12704b392f46658d181c58c9b0fc
Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98

Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp$C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\StdUtils.dll
API String ID: 3109718747-2883646987
Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsmCF3D.tmp\), ref: 004061D9

Strings

Remove folder: , xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.2035754688.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2035715439.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035787642.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2035818394.0000000000553000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2036191488.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Pralevia Setup 1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pralevia Setup 1.0.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\12484ff77995dddb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Programs\Pralevia\LICENSE.electron.txt

C:\Users\user\AppData\Local\Programs\Pralevia\LICENSES.chromium.html

C:\Users\user\AppData\Local\Programs\Pralevia\Pralevia.exe

C:\Users\user\AppData\Local\Programs\Pralevia\Uninstall Pralevia.exe

C:\Users\user\AppData\Local\Programs\Pralevia\chrome_100_percent.pak

C:\Users\user\AppData\Local\Programs\Pralevia\chrome_200_percent.pak

C:\Users\user\AppData\Local\Programs\Pralevia\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Programs\Pralevia\ffmpeg.dll

C:\Users\user\AppData\Local\Programs\Pralevia\icudtl.dat

C:\Users\user\AppData\Local\Programs\Pralevia\libEGL.dll

C:\Users\user\AppData\Local\Programs\Pralevia\libGLESv2.dll

C:\Users\user\AppData\Local\Programs\Pralevia\locales\af.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\am.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ar.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\bg.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\bn.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\ca.pak

C:\Users\user\AppData\Local\Programs\Pralevia\locales\cs.pak

Windows Analysis Report
Pralevia Setup 1.0.0.exe