Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe

Overview

General Information

Sample Name:bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
Analysis ID:452552
MD5:742e56852d000c82ff2716b995fe0a82
SHA1:e8521e02bdf3a2d07bd40857d571724270232ddc
SHA256:9b86d2af5702989a5ab7623cb16b586f03ff5481dca7cd483581825fa7943985
Infos:

Most interesting Screenshot:

Detection

Score:39
Range:0 - 100
Whitelisted:false
Confidence:0%

Compliance

Score:48
Range:0 - 100

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)
Deletes itself after installation
Uses regedit.exe to modify the Windows registry
AV process strings found (often used to terminate AV products)
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")
Sample searches for specific file, try point organization specific fake files to the analysis machine
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

  • System is w10x64
  • bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe (PID: 4260 cmdline: 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' MD5: 742E56852D000C82FF2716B995FE0A82)
    • cmd.exe (PID: 1236 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\start.cmd' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 3160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • spinner.exe (PID: 6064 cmdline: 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe' --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON MD5: D62E71AC7C38F629B101FD06A8FFFBDA)
    • bomgar-scc.exe (PID: 4608 cmdline: 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop' MD5: A72C14740D19970DE5B5F828CF0A72EB)
      • bomgar-scc.exe (PID: 3448 cmdline: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop MD5: A72C14740D19970DE5B5F828CF0A72EB)
        • bomgar-scc.exe (PID: 2456 cmdline: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -proxydetect MD5: A72C14740D19970DE5B5F828CF0A72EB)
        • bomgar-scc.exe (PID: 3216 cmdline: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -elevate silent MD5: A72C14740D19970DE5B5F828CF0A72EB)
  • svchost.exe (PID: 6060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5600 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6140 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • bomgar-scc.exe (PID: 5072 cmdline: 'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -service:run MD5: A72C14740D19970DE5B5F828CF0A72EB)
    • bomgar-scc.exe (PID: 592 cmdline: 'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -drone MD5: A72C14740D19970DE5B5F828CF0A72EB)
      • bomgar-scc.exe (PID: 5132 cmdline: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -exec enum_cp 4041902 MD5: A72C14740D19970DE5B5F828CF0A72EB)
      • regedit.exe (PID: 2148 cmdline: C:\Windows\regedit.exe MD5: AC91328EE5CFFBD695CE912F75F876F6)
      • mmc.exe (PID: 4072 cmdline: C:\Windows\system32\mmc.exe eventvwr.msc /s MD5: BA80301974CC8C4FB9F3F9DDB5905C30)
      • rstrui.exe (PID: 4276 cmdline: C:\Windows\system32\rstrui.exe MD5: 3E8AFFA54035412F86663C8B44CAA2E5)
      • chrome.exe (PID: 5816 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' https://remote.oracleindustry.com/session_complete?lsid=h%3D6e906df6caa57a0814aa268ff3d149259eb8bced%3Bl%3Dd5ad05e5dd134721bd791679f24ee989%3Bm%3Dsdcust%3Bt%3Dsd MD5: C139654B5C1438A95B321BB01AD63EF6)
        • chrome.exe (PID: 4772 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,9401732187181444282,16578066958046228298,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • svchost.exe (PID: 6024 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4820 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 2224 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 1328 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5592 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 1392 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 244 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 460 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 4244 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

  • • AV Detection
  • • Compliance
  • • Spreading
  • • Networking
  • • Key, Mouse, Clipboard, Microphone and Screen Capturing
  • • System Summary
  • • Data Obfuscation
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion
  • • Anti Debugging
  • • HIPS / PFW / Operating System Protection Evasion
  • • Language, Device and Operating System Detection
  • • Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results
Source: 1.2.bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe.2bd232d.1.unpackAvira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Uses 32bit PE files
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Creates a directory in C:\Program Files
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
PE / OLE file has a valid certificate
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic PE information: certificate valid
Uses secure TLS version for HTTPS connections
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49762 version: TLS 1.2
Binary contains paths to debug symbols
Source: Binary string: cp-x64.pdb source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227481948.000001406762D000.00000004.00000001.sdmp
Source: Binary string: embedhook-x64.pdb source: bomgar-scc.exe, 00000007.00000003.227481948.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268499530.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278010165.000001E373EFE000.00000004.00000001.sdmp
Source: Binary string: C:\Source\workspace\triage-trymax\networkstreaming\trymax\sdcust\client\Win32\embedded_cb\cbhook-x64.pdb source: bomgar-scc.exe, 00000007.00000003.227168975.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268253425.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.277730279.000001E373EFA000.00000004.00000001.sdmp
Source: Binary string: embedhook-x86.pdb source: bomgar-scc.exe, 00000007.00000003.227671905.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268558230.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278181921.000001E373F06000.00000004.00000001.sdmp
Source: Binary string: bomgar-scc-x64.pdb source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmp
Source: Binary string: spinner-x64.pdb source: spinner.exe, 00000006.00000002.219891081.00007FF78AC6D000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000003.268730995.000002285A5A1000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278695094.000001E373F04000.00000004.00000001.sdmp
Source: Binary string: C:\Source\workspace\triage-trymax\networkstreaming\trymax\sdcust\client\Win32\embedded_cb\cbhook-x86.pdb source: bomgar-scc.exe, 00000007.00000003.227308059.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268301365.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.277827372.000001E373EFB000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_00405646 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040601C FindFirstFileA,FindClose,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_00402671 FindFirstFileA,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC65C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\
Source: global trafficTCP traffic: 192.168.2.3:49718 -> 213.70.228.167:8200
Source: global trafficHTTP traffic detected: GET /?c=eamesupport&v=21.1.2&a=x86_64&g=213.70.228.167&i=scc&O=337117441&o=10.0.17134&r=6e088c415ffb1d6a800fb6c268869947b60a64b6&s=988683&t=Windows%2010%20Pro%20%281803%29 HTTP/1.0Host: license.bomgar.com
Source: global trafficHTTP traffic detected: GET /?c=eamesupport&v=21.1.2&a=x86_64&g=213.70.228.167&i=scc&O=337117441&o=10.0.17134&r=6e088c415ffb1d6a800fb6c268869947b60a64b6&s=988683&t=Windows%2010%20Pro%20%281803%29 HTTP/1.0Host: license.bomgar.com
Source: unknownDNS traffic detected: queries for: remote.oracleindustry.com
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: bomgar-scc.exe, 00000007.00000003.227168975.000001406762D000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCert
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crt
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crt0
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt;e
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000A.00000003.257854030.00000217A8C5D000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000002.291391957.000001E373EC0000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crl
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crl0F
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crl=cC
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl3e4
Source: svchost.exe, 0000000B.00000002.485002778.0000025CECA13000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crl
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1.crl0
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl00
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpString found in binary or memory: http://launchwinapp.exemicrosoft-edge:about:blank
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227902009.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268607947.000002285A4A5000.00000004.00000001.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227902009.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268607947.000002285A4A5000.00000004.00000001.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: bomgar-scc.exe, 0000000A.00000003.257694439.00000217A8C4B000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com
Source: bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: svchost.exe, 0000000B.00000002.485002778.0000025CECA13000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0:
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.entrust.net02
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.entrust.net03
Source: svchost.exe, 0000000B.00000002.485002778.0000025CECA13000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.msocsp.com0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://s2.symcb.com0
Source: svchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpString found in binary or memory: http://schemas.micros
Source: svchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/address
Source: svchost.exe, 0000000B.00000002.485505217.0000025CECC00000.00000002.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration
Source: bomgar-scc.exe, 0000000D.00000003.278200734.000001E373EF4000.00000004.00000001.sdmpString found in binary or memory: http://sv.symcb%r
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpString found in binary or memory: http://wpad/wpad.dat
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpString found in binary or memory: http://wpad/wpad.datAttempting
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://wpad/wpad.datCeD
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://wpad/wpad.datOeH
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://wpad/wpad.datOl
Source: svchost.exe, 00000014.00000002.311751465.000001BD86613000.00000004.00000001.sdmpString found in binary or memory: http://www.bingmapsportal.comsv
Source: bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000002.290840510.000001E373B09000.00000004.00000040.sdmpString found in binary or memory: http://www.bomgar.com/
Source: bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/%
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.228115366.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/0
Source: bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/=
Source: bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/FY
Source: bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/Lf
Source: bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/R
Source: bomgar-scc.exe, 0000000D.00000003.278200734.000001E373EF4000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/_
Source: bomgar-scc.exe, 00000008.00000002.291463442.000002285A48F000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/ax
Source: bomgar-scc.exe, 0000000D.00000003.278192849.000001E373EF8000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/c
Source: bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmpString found in binary or memory: http://www.bomgar.com/p
Source: bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpString found in binary or memory: http://www.bomgar.com/~
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://www.digicert.com/CPS
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000A.00000002.259511062.00000217A8C5E000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: http://www.digicert.com/CPSZ
Source: bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmpString found in binary or memory: http://www.entrust.net
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://www.entrust.net/rpa0
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpString found in binary or memory: http://www.entrust.net/rpa03
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: svchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpString found in binary or memory: http://www.w3.
Source: svchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpString found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpString found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000014.00000003.289483919.000001BD86632000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: https://remote.oracleindustry.com/
Source: bomgar-scc.exe, 00000017.00000002.452250213.000001AE0EAE0000.00000004.00000001.sdmpString found in binary or memory: https://remote.oracleindustry.com/session_complete?lsid=h%3D6e906df6caa57a0814aa268ff3d149259eb8bced
Source: bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpString found in binary or memory: https://remote.oracleindustry.com:443
Source: svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.311751465.000001BD86613000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000014.00000003.311313558.000001BD86644000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000014.00000003.311313558.000001BD86644000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000014.00000003.289483919.000001BD86632000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000014.00000003.311360327.000001BD8663B000.00000004.00000001.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: bomgar-scc.exe, 0000000D.00000002.290549082.000001E37218E000.00000004.00000020.sdmp, bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000002.291449585.000001E373EFC000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000F.00000002.305985729.000001B2AA879000.00000004.00000020.sdmp, bomgar-scc.exe, 00000017.00000003.311164055.000001AE0EC1B000.00000004.00000001.sdmpString found in binary or memory: https://www.beyondtrust.com/
Source: bomgar-scc.exe, 00000008.00000002.290630004.00000228587D8000.00000004.00000020.sdmpString found in binary or memory: https://www.beyondtrust.com/CK_BUTTON
Source: bomgar-scc.exe, 00000017.00000003.311164055.000001AE0EC1B000.00000004.00000001.sdmpString found in binary or memory: https://www.beyondtrust.com/EM
Source: bomgar-scc.exe, 0000000A.00000002.259321888.00000217A8B99000.00000004.00000020.sdmpString found in binary or memory: https://www.beyondtrust.com/Q
Source: bomgar-scc.exe, 0000000D.00000002.290549082.000001E37218E000.00000004.00000020.sdmpString found in binary or memory: https://www.beyondtrust.com/u5
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.289860502.000001E373EF5000.00000004.00000001.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknownHTTPS traffic detected: 213.70.228.167:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.151.58.18:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040514B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

System Summary:

barindex
Uses regedit.exe to modify the Windows registry
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\regedit.exe C:\Windows\regedit.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040326C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040495C
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040635D
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC61CB0
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC61820
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC65C04
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC64940
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC6B8F8
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC698BC
Source: spinner.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: spinner.exe0.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: remove.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.231801555.0000000003140000.00000002.00000001.sdmpBinary or memory string: originalfilename vs bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.231801555.0000000003140000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.231271357.0000000003040000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamecp.dll\ vs bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dll
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeSection loaded: wfapi.dll
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeSection loaded: tapiwav2.dll
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engineClassification label: sus39.evad.winEXE@67/270@12/9
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040441B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,WerUnregisterMemoryBlockWorker,SetDlgItemTextA,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_00402053 CoCreateInstance,MultiByteToWideChar,
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_Users_user_AppData_Local_Temp_nssC2D4.tmpb_settings.ini
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_Users_user_AppData_Local_Temp_nssC2D4.tmpb_settings-cc.ini
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_ProgramData_bomgar-scc-0x60f9ee75_secure.ini
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_ProgramData_bomgar-scc-0x60f9ee75_proxy-settings-cc.ini
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeMutant created: \Sessions\1\BaseNamedObjects\BF13227E-B446-4E12-913E-7E5FBBEE54F6
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_ProgramData_bomgar-scc-0x60f9ee75_settings.ini
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_Users_user_AppData_Local_Temp_nssC2D4.tmpb_secure.ini
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5440:120:WilError_01
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_ProgramData_bomgar-scc-0x60f9ee75_enum_cp.ini
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3160:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_Users_user_AppData_Local_Temp_nssC2D4.tmpb_proxy-settings-cc.ini
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BOMGAR-INI-LOCK:C:_ProgramData_bomgar-scc-0x60f9ee75_settings-cc.ini
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nsxC2A3.tmpJump to behavior
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeString found in binary or memory: "C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe" "C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe" -install1 "C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe" --installe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile read: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe'
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\start.cmd' '
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe' --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop'
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -proxydetect
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -elevate silent
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknownProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe 'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -service:run
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe 'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -drone
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -exec enum_cp 4041902
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\regedit.exe C:\Windows\regedit.exe
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe eventvwr.msc /s
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\rstrui.exe C:\Windows\system32\rstrui.exe
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' https://remote.oracleindustry.com/session_complete?lsid=h%3D6e906df6caa57a0814aa268ff3d149259eb8bced%3Bl%3Dd5ad05e5dd134721bd791679f24ee989%3Bm%3Dsdcust%3Bt%3Dsd
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,9401732187181444282,16578066958046228298,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\start.cmd' '
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop'
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe' --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -proxydetect
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -elevate silent
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe 'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -drone
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -exec enum_cp 4041902
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\regedit.exe C:\Windows\regedit.exe
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe eventvwr.msc /s
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\rstrui.exe C:\Windows\system32\rstrui.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,9401732187181444282,16578066958046228298,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile written: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\settings-init.iniJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic PE information: certificate valid
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeStatic file information: File size 3613416 > 1048576
Source: Binary string: cp-x64.pdb source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227481948.000001406762D000.00000004.00000001.sdmp
Source: Binary string: embedhook-x64.pdb source: bomgar-scc.exe, 00000007.00000003.227481948.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268499530.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278010165.000001E373EFE000.00000004.00000001.sdmp
Source: Binary string: C:\Source\workspace\triage-trymax\networkstreaming\trymax\sdcust\client\Win32\embedded_cb\cbhook-x64.pdb source: bomgar-scc.exe, 00000007.00000003.227168975.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268253425.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.277730279.000001E373EFA000.00000004.00000001.sdmp
Source: Binary string: embedhook-x86.pdb source: bomgar-scc.exe, 00000007.00000003.227671905.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268558230.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278181921.000001E373F06000.00000004.00000001.sdmp
Source: Binary string: bomgar-scc-x64.pdb source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmp
Source: Binary string: spinner-x64.pdb source: spinner.exe, 00000006.00000002.219891081.00007FF78AC6D000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000003.268730995.000002285A5A1000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.278695094.000001E373F04000.00000004.00000001.sdmp
Source: Binary string: C:\Source\workspace\triage-trymax\networkstreaming\trymax\sdcust\client\Win32\embedded_cb\cbhook-x86.pdb source: bomgar-scc.exe, 00000007.00000003.227308059.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268301365.000002285A4A5000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.277827372.000001E373EFB000.00000004.00000001.sdmp
Source: embedhook-x86.exe.1.drStatic PE information: real checksum: 0x2491d should be: 0x1f1a5
Source: bomgar-scc.exe.1.drStatic PE information: real checksum: 0x96792b should be: 0x96bbbe
Source: embedhook-x64.exe.1.drStatic PE information: real checksum: 0x20c79 should be: 0x1b501
Source: spinner.exe.1.drStatic PE information: section name: _RDATA
Source: spinner.exe0.1.drStatic PE information: section name: _RDATA
Source: embedhook-x64.exe.1.drStatic PE information: section name: _RDATA
Source: bomgar-scc.exe.1.drStatic PE information: section name: .didat
Source: bomgar-scc.exe.1.drStatic PE information: section name: .rodata
Source: bomgar-scc.exe.1.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\remove.exe
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x86.dllJump to dropped file
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\sas.dll
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cp.dllJump to dropped file
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\cbhook-x64.dll
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\embedhook-x86.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\cbhook-x86.dll
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\sas.dllJump to dropped file
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeJump to dropped file
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\spinner.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\embedhook-x64.exe
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\remove.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\spinner.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x86.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmp\System.dll
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\cp.dll
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x86.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\sas.dllJump to dropped file
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\remove.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\spinner.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x86.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeFile created: C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x64.exeJump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Deletes itself after installation
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeFile deleted: c:\users\user\desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeJump to behavior
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe TID: 5988Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe TID: 4072Thread sleep time: -360000s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_00405646 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040601C FindFirstFileA,FindClose,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_00402671 FindFirstFileA,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC65C04 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeThread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\
Source: bomgar-scc.exe, 0000000F.00000003.288472432.000001B2AA8B5000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}AA
Source: svchost.exe, 00000009.00000002.248296181.0000029D1AD40000.00000002.00000001.sdmp, svchost.exe, 0000000E.00000002.286418457.0000025338660000.00000002.00000001.sdmp, svchost.exe, 00000012.00000002.484482074.0000017E37940000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 0000000B.00000002.485346870.0000025CECA62000.00000004.00000001.sdmpBinary or memory string: @Hyper-V RAW
Source: bomgar-scc.exe, 0000000F.00000002.305985729.000001B2AA879000.00000004.00000020.sdmpBinary or memory string: Prod_VMware_TA0#5&280b647&X<
Source: bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpBinary or memory string: VMwareVMware
Source: svchost.exe, 0000000B.00000002.477159879.0000025CE7229000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 00000010.00000002.477950461.000001C289002000.00000004.00000001.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000009.00000002.248296181.0000029D1AD40000.00000002.00000001.sdmp, svchost.exe, 0000000E.00000002.286418457.0000025338660000.00000002.00000001.sdmp, svchost.exe, 00000012.00000002.484482074.0000017E37940000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000009.00000002.248296181.0000029D1AD40000.00000002.00000001.sdmp, svchost.exe, 0000000E.00000002.286418457.0000025338660000.00000002.00000001.sdmp, svchost.exe, 00000012.00000002.484482074.0000017E37940000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpBinary or memory string: WFGetActiveProtocolwfapi.dllSOFTWARE\Teradici\PCoIPTeraHostPathSYSTEM\CurrentControlSet\Control\Terminal Server\GlassSessionIdVMwareVMwareMicrosoft HvXenVMMXenVMMOpenProcessToken %d
Source: bomgar-scc.exe, 0000000A.00000002.259321888.00000217A8B99000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: bomgar-scc.exe, 00000007.00000002.238412139.00000140675DD000.00000004.00000020.sdmp, bomgar-scc.exe, 00000008.00000002.290630004.00000228587D8000.00000004.00000020.sdmp, bomgar-scc.exe, 0000000D.00000003.289545050.000001E37218B000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000F.00000002.305985729.000001B2AA879000.00000004.00000020.sdmp, svchost.exe, 00000010.00000002.478380608.000001C289040000.00000004.00000001.sdmp, svchost.exe, 00000012.00000002.478156301.0000017E36C68000.00000004.00000001.sdmp, svchost.exe, 00000013.00000002.478123403.000001C693E29000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bomgar-scc.exe, 0000000D.00000002.290549082.000001E37218E000.00000004.00000020.sdmpBinary or memory string: ee75\settings-cc.ini&Prod_VMware_
Source: svchost.exe, 00000009.00000002.248296181.0000029D1AD40000.00000002.00000001.sdmp, svchost.exe, 0000000E.00000002.286418457.0000025338660000.00000002.00000001.sdmp, svchost.exe, 00000012.00000002.484482074.0000017E37940000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeAPI call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeAPI call chain: ExitProcess graph end node
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC627F4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC683C0 GetProcessHeap,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC62130 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC627F4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC629D8 SetUnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC622D4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC65694 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\start.cmd' '
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe' --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -proxydetect
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -elevate silent
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\regedit.exe C:\Windows\regedit.exe
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\mmc.exe C:\Windows\system32\mmc.exe eventvwr.msc /s
Source: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exeProcess created: C:\Windows\System32\rstrui.exe C:\Windows\system32\rstrui.exe
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop'
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeProcess created: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe 'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop'
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeProcess created: C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
Source: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpBinary or memory string: shell32.dllShell_TrayWndinvalid string positionwb
Source: svchost.exe, 00000011.00000002.479169358.000001B602990000.00000002.00000001.sdmpBinary or memory string: Program Manager
Source: svchost.exe, 00000011.00000002.479169358.000001B602990000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000011.00000002.479169358.000001B602990000.00000002.00000001.sdmpBinary or memory string: Progman
Source: svchost.exe, 00000011.00000002.479169358.000001B602990000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC6B740 cpuid
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exeCode function: 6_2_00007FF78AC626A8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,
Source: C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exeCode function: 1_2_0040326C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,
Source: C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
Source: svchost.exe, 00000016.00000002.479296462.000002AB9283D000.00000004.00000001.sdmpBinary or memory string: ,@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000016.00000002.479040893.000002AB92813000.00000004.00000001.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1DLL Side-Loading1Process Injection12Masquerading13OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationSystem Shutdown/Reboot1
Default AccountsCommand and Scripting Interpreter12Boot or Logon Initialization ScriptsDLL Side-Loading1Modify Registry1LSASS MemoryQuery Registry1Remote Desktop ProtocolClipboard Data1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerSecurity Software Discovery51SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationIngress Tool Transfer1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Virtualization/Sandbox Evasion21NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferNon-Application Layer Protocol2SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection12LSA SecretsVirtualization/Sandbox Evasion21SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol3Manipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing1Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsDLL Side-Loading1DCSyncFile and Directory Discovery4Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobFile Deletion1Proc FilesystemSystem Information Discovery36Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 452552 Sample: bomgar-scc-w0edc301yf1zhwyy... Startdate: 22/07/2021 Architecture: WINDOWS Score: 39 7 bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe 72 2->7         started        10 svchost.exe 2->10         started        13 bomgar-scc.exe 2->13         started        16 10 other processes 2->16 dnsIp3 62 C:\Users\user\AppData\Local\...\spinner.exe, PE32+ 7->62 dropped 64 C:\Users\user\AppData\Local\...\spinner.exe, PE32+ 7->64 dropped 66 C:\Users\user\AppData\Local\Temp\...\sas.dll, PE32+ 7->66 dropped 68 8 other files (none is malicious) 7->68 dropped 18 bomgar-scc.exe 55 7->18         started        21 cmd.exe 1 7->21         started        92 Changes security center settings (notifications, updates, antivirus, firewall) 10->92 23 MpCmdRun.exe 10->23         started        76 license.bomgar.com 44.224.72.9, 49733, 80 AMAZON-02US United States 13->76 78 192.168.2.1 unknown unknown 13->78 80 remote.oracleindustry.com 13->80 25 bomgar-scc.exe 13->25         started        82 127.0.0.1 unknown unknown 16->82 file4 signatures5 process6 dnsIp7 54 C:\ProgramData\...\bomgar-scc.exe, PE32+ 18->54 dropped 56 C:\ProgramData\...\spinner.exe, PE32+ 18->56 dropped 58 C:\ProgramData\...\sas.dll, PE32+ 18->58 dropped 60 6 other files (none is malicious) 18->60 dropped 28 bomgar-scc.exe 1 2 18->28         started        32 spinner.exe 21->32         started        34 conhost.exe 21->34         started        36 conhost.exe 23->36         started        74 remote.oracleindustry.com 25->74 38 chrome.exe 25->38         started        41 bomgar-scc.exe 25->41         started        43 regedit.exe 25->43         started        45 2 other processes 25->45 file8 process9 dnsIp10 70 bomgar-scc-w0edc30...x1118eejc40jc90.exe, PE32 28->70 dropped 94 Uses regedit.exe to modify the Windows registry 28->94 96 Deletes itself after installation 28->96 47 bomgar-scc.exe 1 28->47         started        50 bomgar-scc.exe 1 1 28->50         started        72 239.255.255.250 unknown Reserved 38->72 52 chrome.exe 38->52         started        file11 signatures12 process13 dnsIp14 84 remote.oracleindustry.com 213.70.228.167, 443, 49717, 49734 UUNETUS Germany 47->84 86 login.oraclehsd.com 156.151.58.18, 443, 49757, 49758 ORACLE-ASNBLOCK-ASNUS United States 52->86 88 clients.l.google.com 142.250.203.110, 443, 49752, 61634 GOOGLEUS United States 52->88 90 7 other IPs or domains 52->90

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe0%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe2%ReversingLabs
C:\ProgramData\bomgar-scc-0x60f9ee75\remove.exe0%ReversingLabs

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
1.2.bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File
1.0.bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe.400000.0.unpack100%AviraHEUR/AGEN.1130366Download File
1.2.bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe.2bd232d.1.unpack100%AviraTR/Patched.Ren.GenDownload File

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://ocsp.entrust.net030%URL Reputationsafe
http://ocsp.entrust.net030%URL Reputationsafe
http://ocsp.entrust.net030%URL Reputationsafe
http://ocsp.entrust.net030%URL Reputationsafe
http://ocsp.entrust.net020%URL Reputationsafe
http://ocsp.entrust.net020%URL Reputationsafe
http://ocsp.entrust.net020%URL Reputationsafe
http://ocsp.entrust.net020%URL Reputationsafe
http://wpad/wpad.datOl0%Avira URL Cloudsafe
http://launchwinapp.exemicrosoft-edge:about:blank0%Avira URL Cloudsafe
http://www.bingmapsportal.comsv0%URL Reputationsafe
http://www.bingmapsportal.comsv0%URL Reputationsafe
http://www.bingmapsportal.comsv0%URL Reputationsafe
http://www.bingmapsportal.comsv0%URL Reputationsafe
http://sv.symcb%r0%Avira URL Cloudsafe
http://wpad/wpad.datOeH0%Avira URL Cloudsafe
http://wpad/wpad.datCeD0%Avira URL Cloudsafe
http://schemas.micros0%Avira URL Cloudsafe
https://%s.xboxlive.com0%URL Reputationsafe
https://%s.xboxlive.com0%URL Reputationsafe
https://%s.xboxlive.com0%URL Reputationsafe
https://dynamic.t0%URL Reputationsafe
https://dynamic.t0%URL Reputationsafe
https://dynamic.t0%URL Reputationsafe
http://wpad/wpad.dat0%Avira URL Cloudsafe
http://wpad/wpad.datAttempting0%Avira URL Cloudsafe
https://%s.dnet.xboxlive.com0%URL Reputationsafe
https://%s.dnet.xboxlive.com0%URL Reputationsafe
https://%s.dnet.xboxlive.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
172.217.168.45
truefalse
    		high
    remote.oracleindustry.com
    		213.70.228.167
    		truefalse
      		high
      login.oraclehsd.com
      		156.151.58.18
      		truefalse
        		high
        clients.l.google.com
        		142.250.203.110
        		truefalse
          		high
          googlehosted.l.googleusercontent.com
          		142.250.203.97
          		truefalse
            		high
            license.bomgar.com
            		44.224.72.9
            		truefalse
              		high
              clients2.googleusercontent.com
              		unknown
              		unknownfalse
                		high
                support.oracle.com
                		unknown
                		unknownfalse
                  		high
                  www.oracle.com
                  		unknown
                  		unknownfalse
                    		high
                    clients2.google.com
                    		unknown
                    		unknownfalse
                      		high
                      login.oracle.com
                      		unknown
                      		unknownfalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://license.bomgar.com/?c=eamesupport&v=21.1.2&a=x86_64&g=213.70.228.167&i=scc&O=337117441&o=10.0.17134&r=6e088c415ffb1d6a800fb6c268869947b60a64b6&s=988683&t=Windows%2010%20Pro%20%281803%29false
                          		high
                          NameSourceMaliciousAntivirus DetectionReputation
                          http://www.bomgar.com/0bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.228115366.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                            		high
                            https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpfalse
                              		high
                              https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                		high
                                https://www.beyondtrust.com/u5bomgar-scc.exe, 0000000D.00000002.290549082.000001E37218E000.00000004.00000020.sdmpfalse
                                  		high
                                  http://ocsp.entrust.net03bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpfalse
                                    		high
                                    http://ocsp.entrust.net02bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://remote.oracleindustry.com:443bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpfalse
                                      		high
                                      https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmpfalse
                                        		high
                                        https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                          		high
                                          https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmpfalse
                                            		high
                                            http://wpad/wpad.datOlbomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		low
                                            https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.bomgar.com/%bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmpfalse
                                                		high
                                                https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000014.00000003.289483919.000001BD86632000.00000004.00000001.sdmpfalse
                                                    		high
                                                    http://www.bomgar.com/Rbomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpfalse
                                                      		high
                                                      http://www.w3.svchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpfalse
                                                        		high
                                                        https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://www.entrust.netbomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmpfalse
                                                            		high
                                                            http://schemas.xmlsoap.org/ws/2004/09/enumerationsvchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://www.bomgar.com/FYbomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpfalse
                                                                		high
                                                                http://schemas.xmlsoap.org/ws/2004/08/addresssvchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpfalse
                                                                  		high
                                                                  http://launchwinapp.exemicrosoft-edge:about:blankbomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		low
                                                                  http://www.bomgar.com/bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.291417975.000002285A460000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000002.290840510.000001E373B09000.00000004.00000040.sdmpfalse
                                                                    		high
                                                                    https://appexmapsappupdate.blob.core.windows.netsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                      		high
                                                                      http://www.bingmapsportal.comsvsvchost.exe, 00000014.00000002.311751465.000001BD86613000.00000004.00000001.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.beyondtrust.com/bomgar-scc.exe, 0000000D.00000002.290549082.000001E37218E000.00000004.00000020.sdmp, bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000D.00000002.291449585.000001E373EFC000.00000004.00000001.sdmp, bomgar-scc.exe, 0000000F.00000002.305985729.000001B2AA879000.00000004.00000020.sdmp, bomgar-scc.exe, 00000017.00000003.311164055.000001AE0EC1B000.00000004.00000001.sdmpfalse
                                                                        		high
                                                                        http://crl.entrust.net/ts1ca.crl0bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                                                          		high
                                                                          http://sv.symcb%rbomgar-scc.exe, 0000000D.00000003.278200734.000001E373EF4000.00000004.00000001.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		low
                                                                          http://www.bomgar.com/=bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpfalse
                                                                            		high
                                                                            http://wpad/wpad.datOeHbomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		low
                                                                            http://www.entrust.net/rpa0bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                                                              		high
                                                                              https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpfalse
                                                                                		high
                                                                                http://www.bomgar.com/pbomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmpfalse
                                                                                  		high
                                                                                  https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                                    		high
                                                                                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000003.311313558.000001BD86644000.00000004.00000001.sdmpfalse
                                                                                      		high
                                                                                      http://wpad/wpad.datCeDbomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		low
                                                                                      http://www.entrust.net/rpa03bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                                                                        		high
                                                                                        https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmpfalse
                                                                                          		high
                                                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000003.311313558.000001BD86644000.00000004.00000001.sdmpfalse
                                                                                            		high
                                                                                            http://aia.entrust.net/ts1-chain256.cer01bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                                                                              		high
                                                                                              http://www.bomgar.com/_bomgar-scc.exe, 0000000D.00000003.278200734.000001E373EF4000.00000004.00000001.sdmpfalse
                                                                                                		high
                                                                                                http://schemas.microssvchost.exe, 0000000B.00000002.477673828.0000025CE72A9000.00000004.00000001.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpfalse
                                                                                                  		high
                                                                                                  http://nsis.sf.net/NSIS_ErrorErrorbomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227902009.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268607947.000002285A4A5000.00000004.00000001.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.bomgar.com/axbomgar-scc.exe, 00000008.00000002.291463442.000002285A48F000.00000004.00000001.sdmpfalse
                                                                                                      		high
                                                                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000014.00000002.311806842.000001BD8663D000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.311751465.000001BD86613000.00000004.00000001.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.symauth.com/cps0(bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpfalse
                                                                                                          		high
                                                                                                          https://%s.xboxlive.comsvchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          • URL Reputation: safe
                                                                                                          • URL Reputation: safe
                                                                                                          		low
                                                                                                          https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmpfalse
                                                                                                            		high
                                                                                                            https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                                                              		high
                                                                                                              https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000003.289483919.000001BD86632000.00000004.00000001.sdmpfalse
                                                                                                                		high
                                                                                                                https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.bomgar.com/cbomgar-scc.exe, 0000000D.00000003.278192849.000001E373EF8000.00000004.00000001.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.svchost.exe, 0000000B.00000002.485505217.0000025CECC00000.00000002.00000001.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://nsis.sf.net/NSIS_Errorbomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000003.227902009.000001406762D000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000003.268607947.000002285A4A5000.00000004.00000001.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://dynamic.tsvchost.exe, 00000014.00000003.311232159.000001BD8664A000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.311327370.000001BD86641000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          http://www.symauth.com/rpa00bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277802360.000001E3721EB000.00000004.00000001.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://remote.oracleindustry.com/session_complete?lsid=h%3D6e906df6caa57a0814aa268ff3d149259eb8bcedbomgar-scc.exe, 00000017.00000002.452250213.000001AE0EAE0000.00000004.00000001.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.beyondtrust.com/Qbomgar-scc.exe, 0000000A.00000002.259321888.00000217A8B99000.00000004.00000020.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 00000014.00000003.311360327.000001BD8663B000.00000004.00000001.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://www.beyondtrust.com/EMbomgar-scc.exe, 00000017.00000003.311164055.000001AE0EC1B000.00000004.00000001.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://wpad/wpad.datbomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		low
                                                                                                                                      http://www.bomgar.com/Lfbomgar-scc.exe, 00000007.00000002.238641114.0000014067638000.00000004.00000001.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://remote.oracleindustry.com/bomgar-scc.exe, 0000000A.00000002.259424007.00000217A8C05000.00000004.00000020.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000003.311273778.000001BD86659000.00000004.00000001.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.bomgar.com/~bomgar-scc.exe, 0000000D.00000003.289879528.000001E3721CB000.00000004.00000001.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://wpad/wpad.datAttemptingbomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.247289915.00007FF72E973000.00000002.00020000.sdmp, bomgar-scc.exe, 00000008.00000002.295487585.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000A.00000000.249501674.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000D.00000002.295406897.00007FF608053000.00000002.00020000.sdmp, bomgar-scc.exe, 0000000F.00000000.287547334.00007FF608053000.00000002.00020000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		low
                                                                                                                                              https://activity.windows.comsvchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 00000014.00000003.311255419.000001BD86660000.00000004.00000001.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://www.beyondtrust.com/CK_BUTTONbomgar-scc.exe, 00000008.00000002.290630004.00000228587D8000.00000004.00000020.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://crl.entrust.net/2048ca.crl0bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe, 00000001.00000002.228726444.0000000002810000.00000004.00000001.sdmp, bomgar-scc.exe, 00000007.00000002.239265137.0000014068FA5000.00000004.00000040.sdmp, bomgar-scc.exe, 00000008.00000002.290951201.000002285A115000.00000004.00000040.sdmp, bomgar-scc.exe, 0000000D.00000003.277381339.000001E373EFB000.00000004.00000001.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://%s.dnet.xboxlive.comsvchost.exe, 00000012.00000002.478090056.0000017E36C3E000.00000004.00000001.sdmpfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      		low
                                                                                                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000014.00000003.311267261.000001BD8665D000.00000004.00000001.sdmpfalse
                                                                                                                                                        		high

                                                                                                                                                        Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        213.70.228.167
                                                                                                                                                        		remote.oracleindustry.comGermany
                                                                                                                                                        		702UUNETUSfalse
                                                                                                                                                        142.250.203.110
                                                                                                                                                        		clients.l.google.comUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        156.151.58.18
                                                                                                                                                        		login.oraclehsd.comUnited States
                                                                                                                                                        		792ORACLE-ASNBLOCK-ASNUSfalse
                                                                                                                                                        172.217.168.45
                                                                                                                                                        		accounts.google.comUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        142.250.203.97
                                                                                                                                                        		googlehosted.l.googleusercontent.comUnited States
                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                        239.255.255.250
                                                                                                                                                        		unknownReserved
                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                        44.224.72.9
                                                                                                                                                        		license.bomgar.comUnited States
                                                                                                                                                        		16509AMAZON-02USfalse

                                                                                                                                                        Private

                                                                                                                                                        IP
                                                                                                                                                        192.168.2.1
                                                                                                                                                        127.0.0.1

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:33.0.0 White Diamond
                                                                                                                                                        Analysis ID:452552
                                                                                                                                                        Start date:22.07.2021
                                                                                                                                                        Start time:15:16:25
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 14m 11s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:light
                                                                                                                                                        Sample file name:bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Number of analysed new started processes analysed:43
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:SUS
                                                                                                                                                        Classification:sus39.evad.winEXE@67/270@12/9
                                                                                                                                                        EGA Information:
                                                                                                                                                        • Successful, ratio: 22.2%
                                                                                                                                                        HDC Information:
                                                                                                                                                        • Successful, ratio: 100% (good quality ratio 89.7%)
                                                                                                                                                        • Quality average: 71.5%
                                                                                                                                                        • Quality standard deviation: 33.3%
                                                                                                                                                        HCA Information:Failed
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                                                        Warnings:
                                                                                                                                                        • Exclude process from analysis (whitelisted): audiodg.exe, dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe
                                                                                                                                                        • TCP Packets have been reduced to 100
                                                                                                                                                        • Created / dropped Files have been reduced to 100
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 23.211.6.115, 104.43.193.48, 52.255.188.83, 23.211.4.86, 20.82.210.154, 104.43.139.144, 173.222.108.210, 173.222.108.226, 40.112.88.60, 80.67.82.211, 80.67.82.235, 172.217.168.14, 172.217.168.67, 172.217.133.103, 23.50.98.58, 34.104.35.123, 172.217.168.74, 23.50.111.183, 142.250.203.106, 216.58.215.234, 172.217.168.10, 172.217.168.42
                                                                                                                                                        • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, redirector.gvt1.com, support.oracle.com.edgekey.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, r2.sn-h0jeener.gvt1.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, e870.x.akamaiedge.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, content-autofill.googleapis.com, e2581.dscx.akamaiedge.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, r2---sn-h0jeener.gvt1.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, www.googleapis.com, ds-www.oracle.com.edgekey.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, edgedl.me.gvt1.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 2456 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 3216 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 3448 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 4608 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 5072 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 5132 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target bomgar-scc.exe, PID 592 because there are no executed function
                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                                                                                                                                        Simulations

                                                                                                                                                        TimeTypeDescription
                                                                                                                                                        15:17:21API Interceptor1x Sleep call for process: spinner.exe modified
                                                                                                                                                        15:17:40API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                        15:18:01API Interceptor7x Sleep call for process: bomgar-scc.exe modified
                                                                                                                                                        15:18:57API Interceptor1x Sleep call for process: MpCmdRun.exe modified

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        No context

                                                                                                                                                        Domains

                                                                                                                                                        No context

                                                                                                                                                        ASN

                                                                                                                                                        No context

                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                        No context

                                                                                                                                                        Dropped Files

                                                                                                                                                        No context

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):451603
                                                                                                                                                        Entropy (8bit):5.009711072558331
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
                                                                                                                                                        MD5:A78AD14E77147E7DE3647E61964C0335
                                                                                                                                                        SHA1:CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
                                                                                                                                                        SHA-256:0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
                                                                                                                                                        SHA-512:DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ
                                                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edb.log
                                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4096
                                                                                                                                                        Entropy (8bit):0.5975851327512959
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:0Fnk1GaD0JOCEfMuaaD0JOCEfMKQmDqtAl/gz2cE0fMbhEZolrRSQ2hyYIIT:0CGaD0JcaaD0JwQQqtAg/0bjSQJ
                                                                                                                                                        MD5:DDECEB77AD0E2EE98DD4CDAD092DEA85
                                                                                                                                                        SHA1:3CD34A235D3891F794ECFFADD1B5ACBDD48AA510
                                                                                                                                                        SHA-256:96C76A18B10BC23245A3FC77507DE0862831BE8A537DACF570B8A9C503272096
                                                                                                                                                        SHA-512:7E73E3AE9E870E93059DC6B7342526998EBA2EC8D021ABBC4F32B4A094621F434916863FCB01BE12CDAAD8EF51C4F3209485B52243362E01B0D376CFE35EA8B9
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ......:{..(.....(....y%.............. ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................(....y%...........&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
                                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                                        File Type:Extensible storage engine DataBase, version 0x620, checksum 0x3210f984, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):32768
                                                                                                                                                        Entropy (8bit):0.0964496894427794
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:Gyzwl/+c3klXRIE11Y8TRX2VtlnC8K0yzwl/+c3klXRIE11Y8TRX2VtlnC8K:l0+cUlXO4bl2bKX0+cUlXO4bl2bK
                                                                                                                                                        MD5:5CB10B49BD0831AAC809875F3B10B77E
                                                                                                                                                        SHA1:3C60F2C4EDCA87C84BC73CB1C9D948EB767585CD
                                                                                                                                                        SHA-256:13FBB1F74B8DFD2A020DB1C12E6B8D3F5D0A1518C4ECF1B7F52DC88E5C561C39
                                                                                                                                                        SHA-512:FC163CA8697D7D231D339E9EFCD23CD3F93B3D0DF613F978517C65D35639417606B4D2F741E40DCD98AA0C2BEF99B9E712028CA750C955210223F12163DB5D71
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2...... ................e.f.3...w........................&..........w..(....y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w..........................................................................................................................................................................................................................................)....y.a.................o].(....y..........................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
                                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8192
                                                                                                                                                        Entropy (8bit):0.11178317787104357
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:tOglEvNKl/bJdAtiR4QzOciAll:Ugt4aCA
                                                                                                                                                        MD5:A530E446BDBA1D38256CF528F8A69557
                                                                                                                                                        SHA1:23BD80DB729C0D894193349EBE9039F9406D89F4
                                                                                                                                                        SHA-256:9F11C70031E963C9F8B5EF93C531C613CFFFAA63FD57CCFFA1AE883917CF0549
                                                                                                                                                        SHA-512:72B49AE0122011705CC244B8E17D1A894BCD3D331D1C43574710DE5BFAA40D1F042ECD6EF2C643FA6B3E9BA0B57964BE43CC35721D3C864EEC4AD1E4BD0B573B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .7+T.....................................3...w..(....y.......w...............w.......w....:O.....w...................o].(....y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\BF13227E-B446-4E12-913E-7E5FBBEE54F6
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):25
                                                                                                                                                        Entropy (8bit):3.3426831892554927
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:HIVDXYHr4v:HIZIH0v
                                                                                                                                                        MD5:63E8819444B404995663B56A82092C11
                                                                                                                                                        SHA1:34AD197827749E5CA94A56459B6C037A0645A0AC
                                                                                                                                                        SHA-256:1C80BD5520D944C4EF4C586D4ED729BAE4187E2269BB5C7C0B32C025C331A8BF
                                                                                                                                                        SHA-512:DA220F961E7C6A0BFAF7C73952721D0A1A5BED175FE1DC16FE78F1CCE93E4084C3A04FCC266D786CB1DF8073A4C5A178EAE26B88490FA51E1238F6C1FBB448B0
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [bomgar]..bomgar=bomgar..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\app_icon.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1462
                                                                                                                                                        Entropy (8bit):7.695587730412634
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:n/RSeazq5Znz9YEAMyVR6bud77a7yUHvgdpnhaTwgP9/xrmwpEfjLh66XnvzH9er:ZSFW59z9pvyVAqd6Jz1P9xBSfjLA6fwr
                                                                                                                                                        MD5:4E1C2DBCE7DF24285629B51AA6B6B370
                                                                                                                                                        SHA1:6C54DE13DCA004FE0D13FDD65D0BA37CEAE3FE99
                                                                                                                                                        SHA-256:C7246092FC210EA481861CA92420C897FC2E88A693E69BB12D3FB3FBE97FF76A
                                                                                                                                                        SHA-512:1EB0CE5B221F4515E9161536AA8E936FC4AE2D4B4E749DD928E26D78FEB6A7678BAE128275FD7565DC272541B514A8DEAC3912D894ECEE53FBAD0DD9900229EB
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....;..E.V....IDATX..kl.e.......m7h7G..I...\4.AD.".Q...../..%D....|Q....$.>!.e...."FD..%....[.v..u.n.....z[[.....<.9...y.s.....VSE.....A..+.t.jK.v.8....X.,.|@..^.SlH..r.p.....>.n.....,.........P..'..Q .s.tV:p{l.....=..."\....z.&.f....<.+}...4.Cn+.i.*Jm../.r<'......@=.%.E..\Y.D .........*.,.E."^....4:K...A1.Ie0.....s..k.....aJ.......G!....}....v...M.6....,....#...i95.n.X41/*...l.sJ...fI]..PZ....l5...w."..R..0M...wa...!8......Sp%Q.5...`X.tW.g^ZT`.D.y+,Y.....'!<..@4....U...............H....|..,3...H......+.`x..#.*....=.w.G.SW_...:.d..+.q..\....x.A3...w....n...l..g.A..Ly.HF,..^.*.H......u...U.nF.=....^......2P .jJ.5....H .B..#dB.....Z....T..o;.......C..S.E.~.K..."..`....t.(MY..../f..9Im.Z..]...`.S.E....t..F.B..0;.'{1%.KEF...5.o0m.z~]7.....Kl.r(+..O.Z.'..8..M..pR.K......s.h[.....RT7.NM.&...`..*......o..@....jj...@Q=..ga........t;.w.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bc-status-alert.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1203
                                                                                                                                                        Entropy (8bit):7.738993625119788
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:NUmT1WtYyXiHLMCGIpKJ81YYQ2umQk6OnWkuJV9NlS2oR:WA7ycgCLKJYAQoJV9vSz
                                                                                                                                                        MD5:CD021CCBE9692C635BEC0CCA1A8726D7
                                                                                                                                                        SHA1:D99C0FA7B0F1213B287304E5DFE92CDD35598E78
                                                                                                                                                        SHA-256:4E6D31C815B0D1A80E6E76D597FA260EE4E697F74861C968BA788F3766569991
                                                                                                                                                        SHA-512:EC8A90300EC7744CDB37D68B31805F9EA76FAC729F09779B297E6E1E09F24A72B7A7CC0F64D2A358004AD51E5910CB5777A83BB3F16E8FF7764675D7D75400CB
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.19..d...0IDATx^..q.1.FS.%P.%P.%P..P.%......N...!.;D...N..W..........+.,.Z.W..`0......_m.....w....,.7..Dz...|.......R~..g...&......O.......B..o.;........i..6%...P....k....A..7..9.0.D5<G.n_.F.,......d.mQ.-I.....%.t.E5.d..z.&.,.R....."...'..r...'..2....]}a)[tL.b9...:...{D..#...B..n._.}.:.S..{G..~.").....<......D.....0.....:?Gb/.6s..S$2..."qfTF..Q.)........-.fdN......B.m.28.....c.....TN.D..B...7...x^..%>..e)cFe(9...2k3....RfT..fFexK.xTX.)gFe.y..(!..Qa............d<*...5.|.....l.5.!.R...'.o.....ci..&...`G..6.h9.A..BjK+.......B.IFe..v.V.R4*...dG...........JZ.Fe......N2*...cG..V.Q...;*....QS..BjI..Z...;*.../..YC....l...R....a..U..w...)...+%%...|.(...+!...[../...Qa.R....):].J..<.......9..E.L.*.C...sr....!...\.6.2,r....+.....5..c.....y....3.].."....O.8..{5#.Af$H\>..<K....E..&....5T.T.......".s.%...$..u\.)w.:..p. ..U,Gb...KJ.=........a&.9b.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bc-status-info.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1112
                                                                                                                                                        Entropy (8bit):7.598783751352799
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:S3y/EUN5w8n8cCLsk+g5L2XDV6xVsZexHU4mKDQuDO9s3UCUb:CpUN5iONXDExVsuHU41HOxC2
                                                                                                                                                        MD5:E709BBD6FCE9B60807F6AA8167C49EA8
                                                                                                                                                        SHA1:98B37B33A250C224F40827677B058F5A0137D32A
                                                                                                                                                        SHA-256:7ED8DEEC8AFF2221463176C59C67AA141B5EB9BF3F0BA0798422C88B443EA3B8
                                                                                                                                                        SHA-512:4993BB522FAEF3D2CDF48A353124BFFD76086CE81A774E7A31ADC701CC6C1503FC096BF08E8BB9925A36CEFF2D88CCF58CFC0A1A479299B7D8EF64877D09985E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.19..d....IDATx^..m.@.F3BF....#t....:..AF...!#d..........;.....G...xH\.V..d2.L&..,..d>..Io^^^..?7.J..5....q..;..?.{}#..!.#Ub...|%.y>l...e+K.s..<..?.......:.B,rhY..... ..eY.g..L.}...P...+k.A.=..]....d.\T.@..q.9.@.2.........2....o.v.......B...WQ....#.......e.X.......!..`.=.jh.DhF.......Q..$B3.G.D...%..Q=.$B_.h.r.U.-Q...$.A......&E..A..X.P.fJ..Q......K9..F%~.........r..QM..r.....c.l<mv..h6.!...l.].s;.Y.DiF..h.Q.%J3.G..^!U.2.....x..G...jRA.........sQ5.$^;.I...j*H.vT....E.T.x.&.$.... ..QM*H<.USA..T.x.....kG5. .\TM...jRA.........sQ5.$^;.I...j*H.v..._...E.T.x.,...~%.\TM.v....U.%....h.Q.%....h.Q.%....h..r7e..E.${.r.....E.dJ.......E.dJ..X.R.C.rQ5..~o.h.&.\TM.D...<K"...,...5 C......5$C......5(Z....h...5,Z....h.......E.Djg.L.1.....E.DJ....Q..E.DI.......].L.Dp...T=G...."......s...E.......zv...A..'9.\T.{..k...Y..=.I....m.z...R..h..4...~.Y....
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bc-status-success.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1144
                                                                                                                                                        Entropy (8bit):7.698352941734368
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:S3S4MI2YS2JK6ZyS5cNPXrV+qY06mUFSDtXtyh8kp:CjhtUK2PZ98FSBQp
                                                                                                                                                        MD5:9ADE5ACEA3E363FA75ABF118C3BC4706
                                                                                                                                                        SHA1:8AD90F2F55ADF178054E2EF6CD47D234BDFBD8A2
                                                                                                                                                        SHA-256:35CE1A89D974EDE39FD54BE898E0F5A91E1EA038C521115E06A590933F763D4B
                                                                                                                                                        SHA-512:74DCF48E55235E78EBDBAB02F90E8C7EE1AFC88A3EADCC138139E413D087A3036EBCA3C2924E864F87DA1D0596320FAEDB52A897F3F7BA78F01B52A5B9B069BC
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.19..d....IDATx^.q.1.FS.%P.%P.%P.%.AJ8..........R.X.G....J'.... ...../.C...t:.N4.q....o..x.?..S...o.:.P..C.u....n..6dIik...k.6....E.\.....-H....?...r..8m..iW.j.5..d.z...g...<...q.b?..T..4+c.lt.2v.... ./.jlK.....lGYT#[.m).x.~.&.......G5.-.(P..g.<./.U...p4...G..^.v....*#..~."...B..H.P.K.X?T..e.....D...4..(.\;C..Q.-.8&..X.J...|V..8&..nO.......(fT.\....mI.0.2R$v...I......dS..d`C2....KJ..Z..L..7*.K...Z....O).....q.~....mx[K9;*..i.Z.KJ.Q!.K.&.>l.....R..mFe.vTH.....[J.Q!U.y...( ...o).T...K...-.Q!.R..u.{..D.......%%.P..%K.......!.7Qk....-.QVZ..BR%..j...Z...cG..H..p(95G._JZ..BR..J.../.....KKKvTH...+.Q.......KK[vr.m...S.....-U.%......a...,.a....ss..).F.Gm......R......x.T.zK.$Tn.N...!C3H.Y..Z.....\R2.._t/....z../e..j.874 .3J...5I....R.&jMm...@n)}E..9...H.)..u..U_T..R.....U.T.b6tE...Z.....#.VT..Y.)/.p....v..........lKYT#[..X...d..E5.....T.k.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bc-status-warn.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):970
                                                                                                                                                        Entropy (8bit):7.585174137113413
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:S3j6jgUBmMRZWKzISSP4pAlIy1EH9avEIzb2c:Cwgcmgbz8llI1avEIWc
                                                                                                                                                        MD5:4263D844C484B0FE56B1F36AAE7B5A51
                                                                                                                                                        SHA1:A37EECE9C00A33240F7F2B27A88EA0C6A430B925
                                                                                                                                                        SHA-256:6407A4AE08A11CC7925EDCD26EA01BFCBF551607F72D481C34838C2EEB277046
                                                                                                                                                        SHA-512:8458E288C18C5840C7383F72A68B714896CC50733E18A099A1553152754B3D3A914DDFD8F1A9EF60BFCCBE76DFDE64BB44C737AA78E8CAC37793CC0C9C01B6D3
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.19..d...GIDATx^..q.A.E..!..!..!..!8....8.B .-....@....*.:....n.........a....c.1..c.1.......g.....MM.._.P............35..I=nJCe.z....R.L.....T..3:n....q3....#...........bL.Th..3.P.9*.@E.Q.&Bw.<S.c<.^^.o.A..P.f.*...cnA..Tc.A..P..%..fGe..<..7.....g."e\......V....k...r..a(.Z=.n..R....R......u$.e.k..........[..."..0.1....*aH..C.C..:...a(.:.l...;..=u<.e...../..x@..C..u|.....#*".eDU...FUD....eA.MQ1a(#E.,..d...C.)*f...SUT..HUQ.f.....2..o>+n...2T\...Qq....".PF....t.\...2rU...Q.a(c......x..%..0.1..a.C...0VE....*z...%T|..(...-]B....*~....0.QJ....~....b.6..3.p.....)RFIu.i0..-sV..<.......-.&U...jx....U.mi.FKo.A."e...Z.A..Tc.PFM5...@m5:.e.V.........0.Q.s7._...@..C.-..:..p.T+...Vj...Vj.0..J.P...R...2Z.5.ACZ.5.PFK.F.h@k.?..)...o....-{.o...|(..U.yP.MWu.Ca6]....|Uk......8.b.U.iP.MWu...c3\....c.1..c.1&...?;..=H_......IEND.B`.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bc-typing.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):969
                                                                                                                                                        Entropy (8bit):7.606184373841091
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:ApVJT5PPm0HoH3bc1vLdhc+Y4D2V6yk/BG9Mz:KfPm0HsohPA4qL9Mz
                                                                                                                                                        MD5:81CACD52DF7B613A6BDAADB532905ABA
                                                                                                                                                        SHA1:9F08A158A84B8D80562DD0611CB87045AE6D6E23
                                                                                                                                                        SHA-256:BD71FEB5B38FF11CAF72A0FA3887E318F670CB5D45321A65B2D83CBF38EB9D23
                                                                                                                                                        SHA-512:A14E3056AA3C37E3CED45F1BEAE0DA7A4DB24A3DCE93B63A31345715EAAFA8215C9E6D3B00D8E09CA07AFC5DF2E4BD7F8548CD4ADB20A9AAE32AE2DDA64EE52F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...P...P............sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z...9IDATx^..;o.P......`....U.k+......).,.3 1..X.!(l...0..l $f.|.......eCB..Hh....:q..!..Ig..9...............................1?.}...s~....4..:/..H.J.y/4W...i..4.Jy265;..XQ7P.u/.G.\.._Q..>.G.c...t....d...}n.P...q.5...m.I......3...].....i4-.d...ln@g.]...,....Kj?vS.a.....]....jr.c.........zI.=.....UkF.3y*9..K..=b..~\.3Ub....;.{..#.e.&t.....L`..?.mj.x..gWn...|.O..R..._.r{.nM.f......#w....M.2).~....qA..qr..>_`.Rfd.._....enH.........a%eR..MWN..sE...J#.=...:..~..R)...4....2)X.\....s.RkW...8.....J..2)....:.....SgN.(.'....Z..iky....'eR..\v...R&EN....Q.C.d....>..Nx..B.1[..MR...c.\..C.*..Gj..n...~8.%=.0.i?.'$=.7U..z....$}..rx.qu...c. .r......W..........r...Q.;..~..r....3....A`.Zx.>.T.#i.... ......_zQ..4...>pP#.c.~.G.ShZ.....h?.a.:>g.Q.*M.U....?g.a.i..4...T-........s.s.&DDDDDDDDDDDDDDDDDDD..+.~...IX.X.a....IEND.B`.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3613416
                                                                                                                                                        Entropy (8bit):7.997178639907989
                                                                                                                                                        Encrypted:true
                                                                                                                                                        SSDEEP:98304:4vV5EiKPNL3F78dXRjYCQp4b8HgQkUVp1YFR:4d5EiKPNL3+dXRjYZg/UER
                                                                                                                                                        MD5:742E56852D000C82FF2716B995FE0A82
                                                                                                                                                        SHA1:E8521E02BDF3A2D07BD40857D571724270232DDC
                                                                                                                                                        SHA-256:9B86D2AF5702989A5AB7623CB16B586F03FF5481DCA7CD483581825FA7943985
                                                                                                                                                        SHA-512:F4B0B9284E53498F9BD67AE1BD1C2C74E39F371CE47376A7E6F48AFEEAA7955DE8B88D62C371A6AC8A897ABF13863E3867B0FBE970E621CA29B48EEB165496C9
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.*^...QF..QG.qQF.*^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...i:.V.................^..........l2.......p....@..........................P.......,7......................................t..........XA............6.(<...........................................................p..|............................text...t\.......^.................. ..`.rdata.......p.......b..............@..@.data...X............t..............@....ndata.......P...........................rsrc...XA.......B...z..............@..@................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):9835560
                                                                                                                                                        Entropy (8bit):6.4461733789956455
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:196608:oVAzO3Zi2MVBbwR/8lbYOZQUTa30A73hsDO/oI21AmtE:oVAzO3Zi2MVBbU/8lbYOWq60A7gOQI2S
                                                                                                                                                        MD5:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        SHA1:5D386180CC0264E9FDC2A3C19B5DF596B4B41F8F
                                                                                                                                                        SHA-256:DFFA4BCE70B25AD616DFA25D79E38471BE6953F8C08C0A8E850C167088940219
                                                                                                                                                        SHA-512:2BE4B63148F205BAE38B35DD0DBC72050F5C94C04456A2B6728D68E81962B00B962BD713DEB6A9532D82B47B91F8C707D8C82065FB459147AA90E1AF740EFAAC
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......'%?.cDQ.cDQ.cDQ.w/R.{DQ.w/T.DQ....aDQ.4U.wDQ.4R.oDQ.4T..DQ.R...aDQ.w/U.~DQ.w/W.fDQ.w/P.jDQ.cDP.UGQ..5Y..DQ.cDQ.uDQ..5U..DQ..5T..FQ..5..bDQ..5S.bDQ.RichcDQ.........................PE..d....P>`..........".......o...&.....p.d........@.............................`......+y....`....................................................d....@...I......H .....(<......X...$.y.T...................x.y.(.....x.0............0o.............................text.....o.......o................. ..`.rdata.......0o.......o.............@..@.data...8....0......................@....pdata..H ......."..................@..@.didat..(...........................@....rodata...... .....................@..@_RDATA.......0.....................@..@.rsrc....I...@...J.................@..@.reloc..X...........................@..B................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\button_cb_access_key.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):2599
                                                                                                                                                        Entropy (8bit):7.8851491293625875
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:9VaRpbiNJEYkGMF0RRnvzyYdHkkyk2a5NbDG1f3L7GLUrgU3vu9BnduDFU1:OR1DGMF07yakLMbD+fb7wUr1f+nwD0
                                                                                                                                                        MD5:4C610F2C454EC9E9FF63D34D5676FBB5
                                                                                                                                                        SHA1:0D9D980624AFD8948B44BF524CD441F111EC0637
                                                                                                                                                        SHA-256:A751FDD03854A217B14136D9B9AECB9444B62FA0EF71A008DB66703A8CB26FDC
                                                                                                                                                        SHA-512:B7A6EAAA937C25FAB2469B56EB8DC92250B7AB3FE2EC133F40E902327C671AA978FCF23E7BA8DFA90762ADE6A819DDCD8DDBA239724273AC7A0B06C615FB6645
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...0...0.....W.......sRGB.........bKGD..............pHYs...........~.....tIME.....'8..O.....IDATh..{lS...?v.8.$....$M#...%!@...1VT.MQ.t.":..24&...4.k7.ek#.T,.....P.k..R.L.<.8.'q...8..8q..........{PH\..+.....|..w...9.....T.....$..BD..{e.".......+.....h.5@.Xs...%.).......K.@......B.....0.....R.UW.....Bt.!....B..=.&.~..9.7.....TVSR\...f... .\hRS.w8x8?..M.HNI....8y;.T.f.e...tut.z...\|c....G..x<.F\.....6...n^x.E.[g.~!..J.....4wyrJ.|.Z]R.o_......i.;.3/'......aeA.q...e...f.WUq.w.[......."...d2.o..$...--.~r.\b.....4.`f&..X.F#.4...z.....{.7.m..]yLL.5k..`.5....=+..:M.).q.&%.[[..z.....LL.Br9...@.J.2&.g..8..].N...7....cx.+6>.h..See2....a% ...$ig......9....8\^/.I. ++.........`.>...z5ii........-......d.4.....E.|>... .....\. &&....s..s..UTT..l.U_.*bbc.Y..=}. .P..........%GJKo.........6..sw76.m&..b.@......`kSS..tTf6.Q..s...`...R.F@.....ko.B..A....Nww7.55|r.BTKK....}..........v;ST*.....j.g]]....9s.."+'.m4. *2........Q......%I....D.$...
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\button_cb_private.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3263
                                                                                                                                                        Entropy (8bit):7.706962757375828
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:S/6JSfUVceCmDrC7XVMszrKznG6baPZKXOORQfAWO1CM8pmBHJ9KbxLwuNbOBjPc:SSJWUxC2+LH6bA2Rg/QCBmjAbxLtNqBi
                                                                                                                                                        MD5:41529DE2E2AB466FCDF7C88809EF708E
                                                                                                                                                        SHA1:3834A44751FDD268780EF101B96B678873EF8493
                                                                                                                                                        SHA-256:9C953F11AD2EE7E7495E71747EBA1BB85002FCC13E0DD91123D24019CF5E367C
                                                                                                                                                        SHA-512:56AEA014D3D68E184E1755ECD70590E270FCBF3BBD460565959CC69718025667FF033B794F42B6C30982917935B6AB1A5D4D2472F41FEAC3099A8F88AEFC6B8F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...0...0.....W.......pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F...5IDATx.b...?.P.....0..@..`.ddd$.0!!!.....nnn..J@.............=f......Z...j1 ''............9......Kff.fii.vM...vvv...@.1b...1 %%. --....:...)..(P.AC.0.............o..8.........e...b.&.E........#.f...J................1..@,.h.:.AXX............?r.#..jA.d........=.ZBBb.._..y.l7...EIH@@...6lll..zX......:.].A..bF ~............. ...F&FP.2..1....$.3.=.... ""..`...#..o.........0.$.t'Pm2(&....";.XXX..%......$'..4?.....?.....L..A1.....G.s.;.C..... ...j}......?....b..L.fN.`....&R....0....].....;P4A..cp2.bPQ.e.t.!,.@43.G.U4....."..2S.d`e...*ax8...5;1..`d....SF.f.......0...3..RW`....,F.....T....qE.;...l..*0f.I.bb..?.W....'.._..3|}........=......... .oO......Yc..X.1.J,.N..S.I.a..a#....Dv.x...............5%.I..?#.. d.....4...........fd8u..c\...............m..~.Er... ......J2.pp...t$#..../.fb.2.C51..US.Q....N\x........d7.....$..._@k.....\f`..=........,.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\button_cb_survey.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1133
                                                                                                                                                        Entropy (8bit):7.754045849146013
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:av8klyUzGi0CF3foxlchpLz6YznEEcNa2:akkkUzfpNfwopySnE9Na2
                                                                                                                                                        MD5:49FF076243C05AA6C44AE526925F966A
                                                                                                                                                        SHA1:6BF0BA5C6AAF838E542494ABA72848E56DB4871D
                                                                                                                                                        SHA-256:79E39B353C0A9424F74356B423DE9C7D4F5FC98DF8A70C40909C8E3BFAF6FBCC
                                                                                                                                                        SHA-512:4134FCC1284088D699412B031EB251FBFB980E0E6C281FD9948B38F2CDC8EC6D66F327B3BF1F5EB68C87587540C2D5A60341CA9186F909E822502C8D3C9C8A04
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...0...0.....W.......sRGB........'IDATh..Oh.W..?of.;.4l.l...n.4.Bi....P.H..<..1..w..!......=. ..y..V....`.,.[...]3.v.yP.J.d.n...e.........~........O....W.J)..y.....6z.......A.....9<<,.%@JI..|...P.bx...!6.A.3........b1<.#....H..y..q....^../.iii...j.%.#G....B..y.&....9s...q............>N.<.k.8..<..D..,.|;X....wP...~.....;w.)%.l..7n077...(..E.^........o..0.'.......`.&B.......................@..........,.....5F@6.]..d2.\.N...k5..>R........5F.vP5..[.2...B.....+.e....sov.c<..!..X..1.....*..<....R.D.=....:.5..W..o?....s..0??....t...|.r.L:......w.r..i..,//.......].u.....B.n.bjj.j.J........yr..kkk......_Y.k..!_.0B&''....RJ*...ea.&.eQ.Tx...{....mR....c.6....Cb.x}..9..}E.....q..Y...H$.$......0.L.............u\..v]....B.=.H$(..ttt...s..477.8.......T.r.L2........+W....u]L.D...2>.........|.2..i.z..(.R......w...1...QU.d2I.T.P(0;;.eY..kX..;v...i..?N.P..S......J..T*.8p...%...<...d2.........;...........m....EX@\.cY6..v}j..B...Xk..}..42..R...
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\button_cb_team.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3851
                                                                                                                                                        Entropy (8bit):7.932174020309697
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:59esNVCDaZ7u/847WmyHf7ahi2waztHHQG:jvjqhyHf7aY2XnQG
                                                                                                                                                        MD5:C280D0EE8C186E77DD3EF60BFC66C57D
                                                                                                                                                        SHA1:57A03C32D25DF8153C507ED427D12FC71C4A0AB6
                                                                                                                                                        SHA-256:DFB4A7AB6125992A5E5B4DA32E96612F317B7B354486FB3E8DEF18536BF30074
                                                                                                                                                        SHA-512:BC614A530781AAFF295EB99C9FA752A41D046DDF9434A6B088219155A9CF9F193CF39797DE4852E08AC0BB49014AA4A86DD3D27EB82C2D9699567734EE0640E2
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...0...0.....W.......sRGB.........IDATh..Yy.VUv...........h..f.e..p.DE.1#31........?.)....2...R.FpR!.#d.....E...4...,..............?.k.:3.:0U..T....{...;...._.W.{.}Y....... "..O..._......TRD...v...[.e.P_.i.y......"...-.?.....;...:....j.y...j....v`.YS=.{.....DD..60..[.~.xg.].8..J...p...$......[7.7......X.Y..B"........$D...Q.oomm.?.w..n.E.;......ED "..b.y..6=.;v...........1.!...1....... ..y..a.... a.5FQ4&.....rf....y..a.%Nu. ./..}2.)... .D...R.5}}}..#..y.h./b.?...}..G..N...........y..".Z/d.[....2.._*.....H[..;...n@uu........d.z{O..v...I...S..Rib.yl.P...=....*....axj6^xi.........{M:.^.....(..F.1....n.m...p2.r..L....g.l.|....Z.H.R...s..~..\j.u|..{....P.)...r..rm....44O..1K.(.b...c...K..`........p.....\[?o..R.'t.7....J.2Y../...}.|.....\,..YS.o.?........QA.. Q.T....x`.?.M..m.y....~..{N.\q..#..]1.I.J...`....D}@..F.2..]..p.86>1o.....91!.j..b.....q8..X+.........l."z.K1oR.2.N..q...a1.......8."b!............}<..O....*.W..D.L.fu$.V...D..p
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x64.dll
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):133368
                                                                                                                                                        Entropy (8bit):6.125577986473236
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:D1U+qaLE1lIBLn4OSsDfyfqaGM/0q5JDruWnvf:D1qaDBLnjS8fraw2J1n
                                                                                                                                                        MD5:AB53301F876C55C4594AB1AE127AA691
                                                                                                                                                        SHA1:B47B88C1E87FB9D87D143AF12BA126EC493FACC9
                                                                                                                                                        SHA-256:0063F3CC125774D1782755D45C5FC40FED202B48D1A03793822DF14662B57420
                                                                                                                                                        SHA-512:8D0093C17D8533AC64704F1D0B62077E8E94404CA4EA57B6FB44DD27657C8EC8C03F5CDEB53061F2C254B4E7C7D83A79B07FB8509C1AE9CDD271791D037F9C29
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............dH..dH..dH..`I..dH..gI..dH..aI?.dHB.`I..dHB.gI..dHB.aI..dH..eI..dH..eH..dH..aI..dH..dI..dH...H..dH..fI..dHRich..dH........PE..d....O>`.........." .................K.......................................0............`A........................................`...................................4... ..H... ...T...............................0............... ...X...@....................text...0........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.didat..0...........................@..._RDATA..............................@..@.rsrc...............................@..@.reloc..H.... ......................@..B................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\cbhook-x86.dll
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):113912
                                                                                                                                                        Entropy (8bit):6.504047019194455
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:SHc92XScGbDq6KOIiior+2xiqgxUuyuX1ktMfZDzsWDcdF32/FuE1ygV:0toVfIiL+2xiqPuX1kOfdUFOFUg
                                                                                                                                                        MD5:E1BA5E5A7A6871FDBC54337BBC89F513
                                                                                                                                                        SHA1:FA5EE626523C1F1327E155B4561984DBB6F8425A
                                                                                                                                                        SHA-256:8EBFE9332EA8FC8654F487A0D8DD1EEA4291F81CC88FFFA3FD0C93F8EF5C34AC
                                                                                                                                                        SHA-512:24C03B4D143AE2A4E4965EE803F9F04953FA844F8A908331A333401C7E97746328DEC14E225362AB6EF895EB974DB3ECB072BBD17F3239A8394239E2EDC1F60B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............k.......k..v....k.......p.......p.......p.......k..........N...Iq......Iq......IqZ.....Iq......Rich............PE..L....O>`...........!.................C...............................................{....@A.........................a.......b...........................4...........X..T...........................@X..@....................`..@....................text..._........................... ..`.rdata...o.......p..................@..@.data........p.......Z..............@....didat...............d..............@....rsrc................f..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\chat.wav
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 16000 Hz
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):19856
                                                                                                                                                        Entropy (8bit):7.234889712783669
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:gj1zxomdMuL4O0jwDKoNZLCctbCdwrRfaKdSTyyBdu1cD:6nX4TwGoNJCctAwrdajTyIJ
                                                                                                                                                        MD5:08071F39F4EB5F201776D297F16DD75D
                                                                                                                                                        SHA1:3682E976A137EBC52D2998404003B908EA7772C6
                                                                                                                                                        SHA-256:9D11DC231676F783BE1C370178CA63FDC3AAD5536B1791457AA2EEDF08553E34
                                                                                                                                                        SHA-512:E19CF7C8C51413EBBBB31C8E8B53E41789E55877034E91EB4EA1477CF899AB7943B1F1E9D4E410276F7F0A603E232E6F80CCF9F804E90B01194C4B0E49F42713
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: RIFF.M..WAVEfmt .........>..........data`<..........................................................................................................................F...&.V.@....'.%%7-4CFwB.S#O.].XRc.]Yc.].].X.R*N.BN?./0-..:.......]."....`....+..........E..........-.....F...{............F..7...~.F......#/!.1:/j?.;.J.FjS.N.X.S.Z.U2Y\TFT.OZL8H.Bl>.5.2:(.&....}...G.h......{.#.\..W.B..p.(.:.K.....0....;......+.....F.....................$.".1//b=.:.F.B.M.I`R.MNT.O.S#O.P+L.K.FuC.?.:.6./w,.". ..`...W.........Y.'..6.P.p.}.)......=.w.....<.W....V.J.F...0......b........k.!.4...o..,.).7.4qA.=PIYE.N.JKR.M:S.N.QGM.M.I.G.CD?.;.5+2B).'6...E.y.....V...7.....4.....R......R...M....b...U.N...8.G.M...Y.p............l.....M.....K&=$z2./$=.9.E)B.L.H:Q.LLS.N.RcN.P.K.J.F,C.?.9y6N..+.!......u.(...e.........z.(.d.........e.t...p....c.......+.}.*.....&.v.b.......%.... ...- +.8.5.B.><J5F.O\K.RCNTS.NkQ.L.M.HiF.B.=C:.210.&.$n...M.......k._..4.........k....=.c..W...L.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\cp.dll
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1215528
                                                                                                                                                        Entropy (8bit):6.383066873567862
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:aIT0EduZ4UevogdHlmu5XVhgKvj4jICb4/DTTXUB8T/1H3On:dT0EduZ7eQwlmuJVhgcsjICb4rTTa8zU
                                                                                                                                                        MD5:FDE6870A0344E155F6569AE797AE945A
                                                                                                                                                        SHA1:8F4F50F1F134328D3991D2FC86B01E509D68E2AC
                                                                                                                                                        SHA-256:AE490AE6C93EB64FFAEF5B304FD4E259B0EFC7EF9103F0748623BCF5DCF046FE
                                                                                                                                                        SHA-512:78B42D0046E10BD671058CBF924FF083C1F5A16E786147CB05DEF562E8ACE7E5D62D379AC7900CDB67083AF0A057937BBD4268E980373CDAA31E665FFFBD6039
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......m{..)...)...)...=q..%...=q........[.(....j..9....j..#....j.......Fa.+...=q..1...=q..(...=q......)...R....k.. ....k..p....k..(....kc.(....k..(...Rich)...........................PE..d....O>`.........." ................p........................................@......w?....`A........................................0...l............... ....0..h....P..(<......t!..`...T.......................(.......0............................................text...L........................... ..`.rdata..^E.......F..................@..@.data............z..................@....pdata..h....0.......r..............@..@.bmgrcfgP............ ..............@..@_RDATA..............."..............@..@.rsrc... ............$..............@..@.reloc..t!......."..................@..B................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x64.exe
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):108792
                                                                                                                                                        Entropy (8bit):6.0505957707788856
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:L9C1ry/jQpd5VAsfS0VJ0JCJjovqXxsWbd09dlXWU9jzTax8n4n:L9C1rqEZVAuVP0JCJjeq1MkUVS8n4
                                                                                                                                                        MD5:BB18D6082ED5B607C6A27C9B27D06F5A
                                                                                                                                                        SHA1:38EA6144FC93B4C1E170380367681602D655A8C1
                                                                                                                                                        SHA-256:6C640317D95D41A22A107C1C2C6FD904138ACF0408F930C06A95A742EB988194
                                                                                                                                                        SHA-512:D60EC2CBF7579256245E6FFEA5740E2D25A6704E8512A703145A816B35549B7484E42A0326F01A538782C1A5819F067789D10503BAA44AC1CC8BB599848161C4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@..h...h...h....*..h....-..h....+.uh....+..h....*..h....-..h..../..h...h/..h..H.+..h..H...h..H.,..h..Rich.h..................PE..d....O>`..........".................`..........@....................................y.....`..................................................H..d....................t...4......8...P9..T............................9..0............................................text............................... ..`.rdata..............................@..@.data........`.......D..............@....pdata...............N..............@..@_RDATA...............\..............@..@.rsrc................^..............@..@.reloc..8............l..............@..B........................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\embedhook-x86.exe
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):98344
                                                                                                                                                        Entropy (8bit):6.4950295039549815
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:r0xwo1rMGMH+H+qnzVvNorhcu2EWGeBFYGDU9HFD6jM:r0xwWUUzVy6u2EsYHyM
                                                                                                                                                        MD5:6FEAD7771A6EBECD4888876E8368C255
                                                                                                                                                        SHA1:6D2302B391D470CAA82B62EE1438E99B96B1660D
                                                                                                                                                        SHA-256:980408B1F10153BD3AD0EB09F043DE252768216EF53FC40ABF258BC3F412B4CD
                                                                                                                                                        SHA-512:296EFF2BC433600E2E232A98986C7CD27452A2BB6DDF103CF2D4E48F3D447C4B846E44FBC9DDFB7C2FB45737F980CC96CEAE21838CE4AB99BE8F6DADF334EAE1
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^...0..0..0..3..0..5.=.0..4..0.H.5..0.H.4..0.H.3..0..1..0..1...0...5..0......0...2..0.Rich..0.........................PE..L....O>`............................0.............@..........................p.......I....@..................................&..d....P...............D..(<...`..........T...........................p...@...............`............................text............................... ..`.rdata...^.......`..................@..@.data........0......................@....rsrc........P.......&..............@..@.reloc.......`.......4..............@..B................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\enum_cp.ini
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):18729
                                                                                                                                                        Entropy (8bit):4.209694283410183
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:jLIb9LKL4TzHfS1WavUxoxAxD77SaYYJ5OFhpErHsocw07yHP+SvMd0qNLdARcPc:/I5LKLCzdavEQoLJ5OFMRc0
                                                                                                                                                        MD5:F146E7C142AB2BB7BC89E1DC192A474A
                                                                                                                                                        SHA1:BFB59061E31537B393B95777CA873E5AB6B521F4
                                                                                                                                                        SHA-256:C387685BDC3D028DF9CD53B5EF00AC64D431B0C8DC9A2485629203C1B0564C4D
                                                                                                                                                        SHA-512:59DE0168E66D4E6B64182B2961DB9016E0FFE922C4F0330C9F18DDAE2D910A716A9932E8949B2F918825497AE3433E26BD19398193DECFD2F06E6EF88CA99C2C
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ..[enum_cp-4041902]..CPLApplets="::{025A5937-A6BE-4686-A844-36FE4BEC8B6D}=attributes=536870916\;flags=9\;name=Power Options\;openCommand=\;parsingName=::{26EE0668-A00A-44D7-9371-BEB064C98683}\\\\0\\\\::{025A5937-A6BE-4686-A844-36FE4BEC8B6D}\;path=::{025A5937-A6BE-4686-A844-36FE4BEC8B6D};::{0DF44EAA-FF21-4412-828E-260A8728E7F1}=attributes=4\;flags=9\;name=Taskbar and Navigation\;openCommand=C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Windows\\\\System32\\\\shell32.dll,Options_RunDLL 1\;parsingName=::{26EE0668-A00A-44D7-9371-BEB064C98683}\\\\0\\\\::{0DF44EAA-FF21-4412-828E-260A8728E7F1}\;path=::{0DF44EAA-FF21-4412-828E-260A8728E7F1};::{1206F5F1-0569-412C-8FEC-3204630DFB70}=attributes=536870916\;flags=9\;name=Credential Manager\;openCommand=\;parsingName=::{26EE0668-A00A-44D7-9371-BEB064C98683}\\\\0\\\\::{1206F5F1-0569-412C-8FEC-3204630DFB70}\;path=::{1206F5F1-0569-412C-8FEC-3204630DFB70};::{17CD9488-1228-4B2F-88CE-4298E93
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\fr.rdf
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):831293
                                                                                                                                                        Entropy (8bit):5.479979803680275
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:HNXqtbApv06QpjjdNmYpsaL8PXP/VAjBl93TrxOHjBLpAtBxtlF:tXqtbApvQpvdNmtj1pQ
                                                                                                                                                        MD5:194E2F17327368BD42CCBBDC6F7E84DD
                                                                                                                                                        SHA1:0EA20EB7EF4965EA126029BC3A96ECA9C25AA149
                                                                                                                                                        SHA-256:0DC96CBB31BD27CB5B19D68B9DC961AB8298B10346A7E00C73F2F4CEAA452F99
                                                                                                                                                        SHA-512:65CA2E0A4DC42E085BB7EDF170C5C05A3FD04376AA9403FB6535D7976BCBD278D41FD2070522232DA2F9353D312BBF06946A379F178F667F1B8CCE19A146DB35
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BRDF............`..o........~.........9....%shortdate.....%..............:............%shortdate.....;....Devices.....*........!.....+............P.riph.riques.....7....Category.....%..............,............Cat.gorie.....>....Driver Date.....)........ .....-............Date de pilote.....D....Driver Version.....,........#..................Version de pilote.....O....#PINNED_CLIENT - %1$s.....0........'.....t............#PINNED_CLIENT - %1$s.....;....Custom session attribute '%1$s' cannot be changed in an authenticated session since it was supplied from the security provider.................................L.attribut de session ..%1$s.. ne peut pas .tre modifi. dans une session authentifi.e, car il a .t. fourni par le fournisseur de s.curit.......w....No credentials found......X........O................>.Aucune information d.authentification n.a .t. trouv.e......w..".NEW! Public Portal Authentication.....L........C.....l..........2.NOUVEAU.! Authentification
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\icon_exclamation.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1507
                                                                                                                                                        Entropy (8bit):7.071641489765068
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:Gy1hpunQWwjx82lY2T3gV82xyJ3VBYr5EGrd66v51xTa0ZSyzVdDFfPPjdU7:GwitNn2cbQJ3n5odnnxvVLfjY
                                                                                                                                                        MD5:0E2703DC00F5FF823D620EA8FE1CAD23
                                                                                                                                                        SHA1:AF5E7B48B02CD0E2BF82EA9668F9F0CF2E2BC27C
                                                                                                                                                        SHA-256:36B4FFCC8D0B3271D1764D76C752BEACC15B7F1715BF569F065269E2FF0B61D7
                                                                                                                                                        SHA-512:817916F44FB3DEBB06F0829ADB2C275930C9948729C49FDCA678DBD069B0469C8AD8322FD2AEF585B7C7416D824DECB6E43FB1DCD065F0C71BB31E3DCFCB995B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:0C6E03FACD5511E0AE26F59173CBFB40" xmpMM:DocumentID="xmp.did:4B418AA2CD5511E0AE26F59173CBFB40"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C6E03F8CD5511E0AE26F59173CBFB40" stRef:documentID="xmp.did:0C6E03F9CD5511E0AE26F59173CBFB40"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.se....WIDATx...k.`..O......xP2)".k<.E..s0..g..D...1.....@...l............v..^<.M..7....}.H..oI.....I.}...i. W6+ 8
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\indicator_pinned_connected.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):963
                                                                                                                                                        Entropy (8bit):7.570940176511189
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:n/Wiz8+fdXEQ57P3dtLuT5XI1mPnHoa2lFRYGQv/Z2zH9eEMn9:O2l0Q5bttLuVXUGINRY52wEm
                                                                                                                                                        MD5:0B9BEDE41678F167C06F5427E79EB4A7
                                                                                                                                                        SHA1:A96A8D83629871AD75B50E84D88E457487F0B681
                                                                                                                                                        SHA-256:B54258A23FDA202D1712B953787344EF1D35FD3D68067A4A80B3EDED975F7242
                                                                                                                                                        SHA-512:A388203A283028CD7408EA28183AA6B0860E5F3B0807CB9E90C3EBF4B00D2F4DA11126195D9460771A84AB7B19A15627AA3FB99733F4535384DB7ED76A7574FF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....;..E.V....IDATX.._H.Q......j....Q).=XF.C.Tj..f`.(.iFQI.$=...`......nd.!.).....P =...a....JM....Xw..Y.....|.w.{."....a.../...~r.+..C..R..j..F1T.3S..z.0...fd<,...`.Q....Kh@....=...!LNh3FYa.A.}.6f...i...^.......*..'....[.A.g.....p.Xb<..i...md.N...;.^......x....VzbB@.a................[...3.xf..6#p........eLEc'.7.(Pr.....y..|rO..N.p.kE..&.<#.O..~Qn..jp.....+.+.. ...?@...A...3.b......`........F...!h......Pt....q.P..&..~.....r....f..}v/S]F=...m1s..N..........m.A..4.UPp......S-....xi..mJ.*.z3.>.......z8P....[mp.=D....x.6..n.z.P.........`.)}.v.Cz.w,..R.h>.m@Q.....s.8.`b.~.....D.z...........Z+e.k.l..f.S....G.Nh*.....uP..kStS.3...6....;.5..B.rCt.`07+..:!..B.Z..j......x...]?X.y....8.K...7...?L.Q......%tEXtdate:create.2021-05-27T15:59:02+00:00..#....%tEXtdate:modify.2021-05-27T15:59:02+00:00.[.B....IEND.B`.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\indicator_pinned_disconnected.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1266
                                                                                                                                                        Entropy (8bit):7.585646599202655
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:n/SpTDcGCXT8As4juEgiJWwl8eLs0n/hCy/gax9cDHMzHhEMnO/1:eDFCgDzEFJr2KsA/oax9kHM1Er
                                                                                                                                                        MD5:7F9AEEA0DC0210D5DA1480E2E9AB6D05
                                                                                                                                                        SHA1:586973B8FAE273D23CAA07604FE54A6D12A1F679
                                                                                                                                                        SHA-256:DA144D8FDC5CBB2E4D27E5426044056DBDEFFCD829F34AAF29141ABBFFE41500
                                                                                                                                                        SHA-512:11C648D040A8CEF9F6503E02FCC6C4A58BE12BEB177745BFC08E87BEEAFB505AF40B061552CCF35C7F1BF8C96AF4BA5EDF510A01F65E1C779FC71DC5BE86FEEF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR... ... .....szz.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....;.kB......IDATX..MKr]...Z..)}G.M,.A!AQ.5.QZA..I.4....!a...JP..Q4..K..9../?...55=.7..s:..K.p......}..JE..U..P.@.{.ZZZ`4.....o.$..fgg!.J.^.....M466B .. .TW.mll.\.........q........`0..'I.B..v......E.`kB>....a..r........y.^8..8.N.b1..H$.V..H$..n..l.E}bi..........ahh.555..(..c}}.<.......r..kkk.C........g4..ph7..l8>>F6...zzz`0.@.D.....X,...~p....g..d.....Wl@.P`zz.1.z...h..............nwI<.H`gg...R....W...t.B!h.Z......a||<..`0 ....J.*k....bkk.///....F..D".P(..j...{.|~~.sss..*...P.:...W..H$H$.p..C...f.5.ggg......P..J..6..p6..(t....D"...IF...%.f3...\...\.fff.2@[....r......^F..d....<.....`....+.@4.-...I.,..............hm$......]~.....$I...<|tt....~..mmm I....E......d2.\\\..z...H..NQ..N'|>....K..p~~.\..h...X.V....l6...Q)..A.XYYA}}}.....8==.wb...x....Ep.....\2.(....>..t>...a4..J.~f..|...........R......_}..........&.'YSS..Zm.\.R.......=.B!V8...t....(.l6.N
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\nudge.wav
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):58224
                                                                                                                                                        Entropy (8bit):7.610540877002438
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:QzHJNlD/8LkEsd2/AgnzZIzkOpSUBitMolg:ENh8LkEsk4gnzZIAiSMoi
                                                                                                                                                        MD5:3DB154797700E68E9E8E9BED55A7F2AE
                                                                                                                                                        SHA1:8C3464BC95A3C1AC2A880E3D25763FCE595544F4
                                                                                                                                                        SHA-256:CB2F2418945ABF8169C15164274B30E957B0F302F6B732E03FC624E5542408BC
                                                                                                                                                        SHA-512:D012EA10ACA0B047473C7E72B828876BBDDFBD02206A48198F11A95E28CBEB315F0F5270AB6B7B43728B0B2CE5F609A58CA16D20DADB6512428855DD5695358C
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: RIFFh...WAVEfmt ........D....X......dataD.......R.s.y.V#.)h0.6f<.A.G.K>P-T.W.Z8]a_.aDb.cOc*c.b.a<`.^h\.ZAWLT.Q.M-J.F.B.>.:.733Z/.+.'{$0!....6...H...<...........l. ...........E.......X.......|.g...^.....c...S.{.a.............e...B......'.`....a......................r.C.h.......c........Y.........e...M.......,.Z.[.<...f.........E.I.".......... . .!)!.!. ] ..-.....F...........k.Q.O.....`.......?.. J".$.%.(9*.,..S1.3I6.8E;.=.?"B*D.F.G%IYJEK.K@L=L.LZKQJ.H.G.DTBf?.<k8i4.0d+l&/!..'.E.1.....R.....'............../..............F.G...............e.-.2.~.............#.i....,.Z.a.V.'...V......b...Q.z.x.:...B.......r.4...9...,.....s...a...~.".............Y...l..!.".$.&.(.*.,...1.3)547'9.;.<w>.?VA.B.CYD.DNEoEbE.EmD.CpB.Al?.=h;.9w6.3.0r->*.&.#S.w.......~.|.........8...m.2.../.w....y....e. ...+...........@../...]....g....3...3....*.L.d.U.>....O...Y...+....(.....?..4....3.(.A.....o.{..6.......l.......%..U.4.<.o...2...U.....;..!.&++./.4S8x<c@(D.G.J.N.PgS.U.W)Y.Z}[3\.\
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\pinuninstall.bat
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):65
                                                                                                                                                        Entropy (8bit):4.587226082026236
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:D/GjIWtAdASmL4MMv:L/d/1vv
                                                                                                                                                        MD5:71D2AAFF7A2DB28EC9C4C69FB932449B
                                                                                                                                                        SHA1:998F78994B4DA4E8B49E6E0CF0EC63A40C96A73C
                                                                                                                                                        SHA-256:6213F323269B7DB7BE0857F983C394D69C8EA2F6981014C54E36F7A7AB9C19E5
                                                                                                                                                        SHA-512:1D5FEF1EF55E48EB507DF0382E0D3554098E2A05E5FA90557C2BE243B5D186FE1EDDA9F3354067828AD5AD35B399EC1713A36AF011CB97EC18D5595ABF912B0D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: cd "%~dp0.."."%~dp0bomgar-scc.exe" -pinned win32uninstall silent.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\preload-en-us.rdf
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5171
                                                                                                                                                        Entropy (8bit):5.725831743615018
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:af8IzWk7V7r50q/ToDCjqviFWDzrPI1Rk5DPkD4PuPWP2uyfRLIh8RSCPZ:afPWkc9DCjqvJPrw1RkVqehix
                                                                                                                                                        MD5:71E8A8D8291076605FBDD05A8CCE0324
                                                                                                                                                        SHA1:11F0F96591D3C699A8114E37BF6B53BFBDC8804A
                                                                                                                                                        SHA-256:D76A487302557577B0CA56364FD2BF9D1A901FF3293E3EF4FBC972A4497C11E7
                                                                                                                                                        SHA-512:A1170834FAE699CE4D3C565CA668CBB65483BF7DA00C48F8539C4A281EA47C041329052E381506E62D60D8A275147E752199CE1CFB7887235CFEFE75791D9D4B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BRDF............`..........................j.... ....ABR_REP_COMP....#ABR_PRODUCT...../....APPLIANCE....Secure Remote Access Appliance.....%....CALLBACK_BUTTON....Support Button.....'....CALLBACK_BUTTONS....Support Buttons..........COMPANY....BeyondTrust.....z....COPYRIGHT_NOTICE..c.Copyright . 2002-#COPYRIGHT_YEAR #FORMAL_COMPANY. Redistribution Prohibited. All Rights Reserved...........COPYRIGHT_YEAR....2021.....-....FORMAL_COMPANY....BeyondTrust Corporation.....!....JUMP_GROUP_FULL....Jump Group..........JUMP_GROUP....Group.....#....JUMP_GROUPS_FULL....Jump Groups..........JUMP_GROUPS....Groups..........JUMP_ITEM....Jump Item..........JUMP_ITEMS....Jump Items....."....JUMP_SHORTCUT....Jump Shortcut.....$....JUMP_SHORTCUTS....Jump Shortcuts...../....LOCAL_PUSH_JUMP_ITEM....Local Jump Shortcut.....1....LOCAL_PUSH_JUMP_ITEMS....Local Jump Shortcuts.....(....LOCAL_PUSH_JUMP_METHOD....Local Jump..... ....PINNED_CLIENT....Jump Client.....,....PINNED_CLIENT_JUMP_METHOD....Jump Client.....
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\proxy-settings-cc.ini
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8368
                                                                                                                                                        Entropy (8bit):0.895231567913114
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:GqA48ZwK8ZOGJUbZp5mZRrN6qA48ZwK8ZOGybZp5mZRrNb:GqAP/EDkClN6qAP/EkClNb
                                                                                                                                                        MD5:DFA36BAB0DC5447086BC327C35137547
                                                                                                                                                        SHA1:ADBB221D35E1C68B372BB0CF33CFA4DC3939742C
                                                                                                                                                        SHA-256:0367B0CC8EE6D171B874F16723A625EE344A4457B0D6745C6F88A81DBD0EBAF6
                                                                                                                                                        SHA-512:193D3B7E1F0DEFB6A62BE851E7600D46C52CD2DA71281D46ECF39DC10D8ED1D151A9932D09B62F7A96BFD6C90703218882260E7439227BE0F1497DC38644C548
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [Proxy]..version=2..[Proxy\ConnectionEvents\remote.oracleindustry.com:443;remote.oracleindustry.com:8200]..connectSuccess=1626992283..proxyDetect=1626992257..[Proxy\remote.oracleindustry.com:443\Detected\1]..Proxy=DIRECT..[Proxy\remote.oracleindustry.com:443\LastGood]..Proxy=DIRECT.. .. .. .. .. .. .. .. .. .. .. ..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\remove.exe
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):67240
                                                                                                                                                        Entropy (8bit):7.172335902462493
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:uRPYqa5pic6jXFdL2KiMc4CMcqpV/TUWQ:aPA6jXFN2MclMcqpV/4W
                                                                                                                                                        MD5:FA8BBFB36D09D1D38F57E91A607BF99F
                                                                                                                                                        SHA1:63C9224FAC984C66AAFA8F585FB9623AC25ADC20
                                                                                                                                                        SHA-256:5A0A7F63B1ED8F47C868881E23ACDE459A3819FD8BD852DDAA69238E1385A0ED
                                                                                                                                                        SHA-512:5A870302539F505C35370AB9AE540863839C35BADF525082DC7335667BC0065950DBC47E7914A5ECD7308E13E91EEBF5B0EFD22980588F8B6F78AB23D2B558C8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.*^...QF..QG.qQF.*^...QF.rv..QF..W@..QF.Rich.QF.........PE..L...i:.V.................^..........l2.......p....@..................................a.......................................t...........................4...........................................................p..|............................text...t\.......^.................. ..`.rdata.......p.......b..............@..@.data...X............t..............@....ndata.......P...........................rsrc................z..............@..@................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\sas.dll
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):28200
                                                                                                                                                        Entropy (8bit):6.590359083765975
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:QhGvUaRk5QzPbW/9wWoAhauP/irNrZk6kbPx:iCi9thauXirN2665
                                                                                                                                                        MD5:5764B3B3463A07B9D1FC39E6EBBFB277
                                                                                                                                                        SHA1:4A4FF583204D244C8FA06D0C46F4D5C0AFD42342
                                                                                                                                                        SHA-256:7502054D97D2E78E1D045A60B8AEEE1654FAFD239329B336FD09A386581E1F65
                                                                                                                                                        SHA-512:76EA632C83862E35E9D5C06184B8F8B20A8C94436EB247099E9A94C6B64BB40E8497915D3DCC6B0319CEE3CA73C2E41970A026D873926FEF923668558BBD1423
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.p.{...{...{...r..z...{...P...r..|...r..q...r..z...r......r..z...r..z...Rich{...........PE..d...i..J.........." .....$...........$........i%.....................................J....@..........................................2..B....-..P....`.......P..D....2..(<...p......`...........................................`.......8............................text...R".......$.................. ..`.data........@.......(..............@....pdata..D....P.......*..............@..@.rsrc........`.......,..............@..@.reloc.......p.......0..............@..B...J0...K..J;......JE...K..J;...o..JR...........msvcrt.dll.NTDLL.DLL.KERNEL32.dll.RPCRT4.dll............................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-attach-hovered.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):2137
                                                                                                                                                        Entropy (8bit):7.8159577929553326
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:C4f69t9Q2Hn7lP2b19DT0mRUTyN39yRt2/:C4i9t9VH7lPQR/iTy/yz2/
                                                                                                                                                        MD5:BC5A365CE42DD94114762E65738A6FA7
                                                                                                                                                        SHA1:6B67704171A112E6377913726B402E2655D4D5A4
                                                                                                                                                        SHA-256:3B464E84EC9BB94DC5159D3FB865E887507D622E2B97C6A42187780C41E898B9
                                                                                                                                                        SHA-512:AD1DED7236A989C9033F6D888E2F619649031ADC10775E57F3247E4565BBF95CD04A7A9E92436C806589447F436F9D306FF7A14B20A1294E502D07F6431256AF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.19..d....IDATx^..sSe.....y...z.u.Q.....q...2..8.t....xAKe)..).6M.sN.....u.Y.. ..6...r......3.A.=..I....y>3.....7.<..s.L... .. ......]J.D...T-Y.`.K..m.H#..E..aZ...............:t.4^w....n1..PT-.8.....B...1.g........4p.N7.%G|....O3=...?.i.Z....'.....t..o.?...K^..F.......b.V.C.&1=Q....{x_._>..Q\p;xx....Y..?.......u.@b.........H..|.n.oATB.q|..|#7?>.O.."...w...?Dl.Fz.kI..x.y'W.>2..].r.|d....Wh.u....{Q.T..g. .Z......OmQ...M...PG.V.<...HX..w]_..L....O......s....b.(.:4..).0.....7.&..c.>........P.4...0e.....cb.n0...|..z..".&I..o..e{N.!...sH.../..f....h.$................<7J..&]_...mK.z.f1L..&I....C.... .<...]....D...M".N.&]W.......?.a..4............Z.I.W.[./c3..%.I7\...Os..b....o....p..p-.6bB.X........."@.l..T@=.k..V.._U...o.At.....W...._...F.q..|.k...P..!.......g..h.$..*.9$..P|].D....0F....W...u..T.C...._M.S.~..(..,.(...U.h..(..,.(..8..'.N..I...x..$(..8..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-attach.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1165
                                                                                                                                                        Entropy (8bit):7.60995073664814
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:NV4hZPHUnaspPBQeZEWowdYuYuYsFT/qyvEJggj7vqgqXgQCu7ky:jbnasNB5ScdLLPTiyvGD7ygqXVtr
                                                                                                                                                        MD5:5035F9D46B6FAD0AC28377AAD527D9D8
                                                                                                                                                        SHA1:F2B0A2F3D343499F96082F693105184AECF25D5B
                                                                                                                                                        SHA-256:6081301FE9E631E8E64E11DF3C004F17F3517A3B50FD2BD61C678D46EC13E91E
                                                                                                                                                        SHA-512:49F247F3C3657957C5744530C7474C9689CEBB87F2E306D0B8E69F0B4045B9541C1703833CED457F579ABBB9B4C8B8AD00DE541F461D8AA1BB1FAF18C024F042
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.16Di......IDATx^..MHTQ...h....(.(jQ...]...-..E..)....0BC...8.Gn*kQBP.. Km$.3..]...W..6.9N.g.......l.9....F..E...........e5.....x.Pa].0I#.......+...Xh.O...../.8.....Tbh....(...>:....F..T*?]..z..e+..j/].aD...5.....,U..w.g...........c.6j..j{....#...V.G.....|..+.C...<.-..^.D.Mj..w.1H..E/.WPKL.#{.4..+&.E...s.\....B.....'j............G..w,..WI-....P.;.s..b.......b.....X.jJ....?..Lx.1w..`f .f..w>...>s.. %.ff.K.......GX..$.......$..f.>. %...u3........0},@J..... .,.%A0X.K.`.....`......\.....$...pI..... .,.%A0X.K.`.....`......\.....$...pI..... .,.%A0X.K.`.....`......\.....$...pI.....-....m...HfJ.-..O.......LI....8f...pL...K.|.Ja...E..m...HfJ.$.}F5.TS+......i.`.4..l..Zy.[..UV...L.~..{...V.....D....?.g..s.*r...z*/z...p..5.3^Y.z..Ojs\%3...p.\j..........d.Z.}N/.3.s.....#..@'......y.2.S.n..}.:0-.0_.M.y..-.1U.?\e......{4..=..P@.*(.yd..EO..pwR.8\`...x.+.%
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-banner.png.n$t
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1877
                                                                                                                                                        Entropy (8bit):7.790272020976159
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:UGgpi2sr63bGTqTfVXY01JIgQ8imZ0EcBZZ1Ev:QTRbGIVoYIrxM0Ed
                                                                                                                                                        MD5:6E386B6F0DBDCC7DEDBFFF2D2CBE592D
                                                                                                                                                        SHA1:2563FEF432EA667198B17A0DE6244E8FEC3822C4
                                                                                                                                                        SHA-256:17AF2F96F5870C7EABFADFE0C861BCD8714AB458391165750785CB316A31CFF0
                                                                                                                                                        SHA-512:2337EFDEEC786826FC5BAB729D3AD8A20C9901368C52972595EE74125775F1C9781CE0632DAA79CD173E5B0BBD8B791C0408614D775FBADF324F367ABF7E8F33
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR.......(.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...3PLTE.U...@.`...P...........`....p.j ..........u0.....u.r?....bKGD..o......tIME......5..5.....IDATx..Z.r.(....8.....3......WNv.D.0.. Qjaaaaaaaaaaaaaaaaaaaaa..A...%...K..|.[.....@.....@tss..M...}9..'.v.=|..q...[..).n].7w3.BD[z.....u.m.O.{..@..4}...m...x{s.....b.....T.E....o....*I.3r...{+..Z.j..'....C....2..lT.A... k..6.*.*.w..z..I...h.;.q_b.3......3.!/.1...T.........s.T...$.......a...#QckSf'J.!8..d..r.......\q.],.o.`.=.....^.\%F.JM.C..;.1...;..o*^E....M..........[!$...L.z.k{E..^......#.;.............=SA"..y.fu...B.p.............>....P.V..BpI...by&l.\....k.t.....H.A.-...........`..~.....,1....o2y+....k..v.&.Y..=]..L....:7d..n....,5*v...i........L,O.^...`.;[D...[......C.*.;.......q4...B.$.Uo.>&[..2..a....b.....V..%X.....H|m....=x.u.s......l.]...S(..o...............v}.h..pc.....;.\....I.X..Q]..O..h....M.]...D.D...Bk_...m?ys....{FN...`76..:8.1...$.?".....
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-chat-flash.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):12131
                                                                                                                                                        Entropy (8bit):7.763731347796219
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:P8iMjGEJRe0knM0QB8V+qEtQzKSqLsNZFWPFZ28EfDMumCRuHt:+GEAn3Q+zEtQzgsNZFAfbE2E2t
                                                                                                                                                        MD5:BB64E025269B39754DB687D6CCEE1011
                                                                                                                                                        SHA1:EE19BAFAA0CD8AEBCC73AE7CCD6C6656F6E7311F
                                                                                                                                                        SHA-256:567EA2248F55577ECE97CFEB36CFF649C777487BF785CF3A0D116468E8584803
                                                                                                                                                        SHA-512:DA4FC769D672C64555AC726383E3FF22600F00150EE33E6F95F33247CA6693A1D4FDC2AA591181C774D4982EB4147F94F6067116537941ACA2C5F5B60ABF80AA
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR..............x......gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.173n.c....IDATx^...UY....A..6.. \.. 2.I.. #}..g$N;#fj..m.M.A...#Si.L.2.8q.01T.HM.H.. ....~.H...af.SUmuW.....q..^.=...Z.............._#.../..rQv.~9,G....$..FrO.w<.'..@..{GV....g.g.g.2..2..2...&..B..M...G..1.Iuu2...&co...-.}.......w..j.y!..B.!..h...{.&......M...:.ua....#[W...#..B.&..b....E~Sj..~l..l...uj.vgZ..B...Dd.....y.c...7.....m...m.'m.B.!..h.Y.;.....iN..0l.......R.|..B....a'....vv...._...mg...mSN:$...UlR.;.|Zn.....mc...)..!$J4.o.}rF..3o.@....-X....!.....}.....K..k..F...J..BH-...W.]Wnw...{`=.v...w..BJ..h...!.,....Y...em....B..@l'..%_....x.7.7kk....'..B....7..W.3.16k...)..!......X&}..[.p..!.......E.f<..=....9.B.yY4`..u.F-...VX[.6...!....v..6...x.(...9D@.....v....].....}n8D....x[...........|-..M.!..hp.&.T.......oX.YL..B....bgCs...1.W...N..B../{.=.....l.....[.BH..@e.......3...>uT8O..RN4(.e|'.}../...>f}....!.E....u..>`Xv.A;a....B....;..E.~.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-chat-hovered.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):11518
                                                                                                                                                        Entropy (8bit):7.748157744603988
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:rsfCYp9sF2lIrWTgolT1Ng9WGFkaeo7oyn/Wz8CufKUHFN5E1HGpUCQ6/Ab47qyE:pnblox1Ng9WGFkaeo7o7z8CcKuXzG6/E
                                                                                                                                                        MD5:E7F345C660F7810A244B680DC837B7EA
                                                                                                                                                        SHA1:0EA4245220209E00EDFF10C322EA92A5C5A00A67
                                                                                                                                                        SHA-256:66024A8358B391178028019755AA7A38178AAC74324B45B28C7E706F80A69617
                                                                                                                                                        SHA-512:D63D747F1F4CC3A0410889CFC87700910FCC98CAA3E28298B6CF37640272F01E71FBB2CA1D88560D5C3D8569461819AC89AB953BB78FEC5452B931ED5CBD7B6E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR..............x......gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.173n.c..,{IDATx^..=.U....X..m... ..vk.d.....! @....Y.....+..." p...............8pK.........E.%.....8 `.....v=..|....K?..F..N.}.....Oo..P...L..>....F.........?...................m...g.I.6...gu.......Fs,.....Muw3.....g..A.....w..Q.W...ww.....E..:...m~_.o..U...=.zL...1.c...=..zb..l.T.n...D.$../...c..P...S=.z..c.`Mv.........&.......k=.z..;............t..n..\....h..;..FC.~W....%.9..$.......t.>....M.;..........."..6...|3<........X.k......]...v8.n.}..r.c@........d........_..e...1.cE.;..f.E.r......uE<.M..c.W..$..TH...$<..+..N..-.c\..M..@%.!.}.K/..Dc.c.c....Zv.(...(..}.:..:...P.....M.jhq..3.(.]...a.......c.cW.;....E`B........t,..FF(.].F..K...n.B.r....-.L...#..V.=k^.l.....0......R._BD.....s.3. ."0..Awe.-...tn..9..9.....=:..ih..G.Z:Wt...q.......@.[..h.t..\r......lH.a^...........@o.".&}..Z.5..p.......5...H..."..>.q....A.?...E...D.......M..E...\...
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-chat.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):13186
                                                                                                                                                        Entropy (8bit):7.785415595528847
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:ctuNslmClFUjiIjvXvCqTf3FOdgO+FP9wsK88i7TxN:ctu4lFUW8/CqLFmgZKsK2b
                                                                                                                                                        MD5:8EAE4FC3A16A7EED2268E295A420A0BC
                                                                                                                                                        SHA1:1170653FFB4E915B4FFD3A142B62A57C20E0FEAF
                                                                                                                                                        SHA-256:7A90830D5EEDC789E89DED68482BDB5CB250FAAC2B6375009912815EAE3FFD1D
                                                                                                                                                        SHA-512:6567D2BF4102D97ABAA33BD35EAB8929BB9F3804AA9928F75823F10BB5F80E868C82D7A634D3D8FD54A28E6E9FF98B3EA716F2AD9B876127352F631D0367CF45
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR..............x......gAMA......a.....pHYs..........(J.....tEXtSoftware.paint.net 4.0.173n.c..2.IDATx^..].U....6.L..L......X..&.`bb5...`LlL.V0&6&.VH#.E......P...!T......^....y...5.M.4m._......g..>{?..?.\8.9g....5..3......oH....r1*6..b..)..}.aq..(&.(..!1....~.~.~...........PXlB.!.X..r@....j....d...N..$..]v...].;.w...U..@X...BH~..nP..:.m.....&NOt...u..F.......!...#..,......|.H./....u..R...Yau.B.!.G&".....=6...&1.O..s].....B.!....`....U...nN.C3t...@..p.|..B...CO.....v=y.....N..nK..tH.!.RtR.zly.8 ..>_.mu...mNA@.!^".~......`fM..C...m.....B..!2...k.O...a<.6..h[....!..T"..._.z]......h..6...B..52@..v..]...Q7mS...q."B.i32...|z..=).......'..=N$$..&..n.x....G..j[.. .....k.`....r1.9...2.. .@........h.]..3!...E.L}........m..y..!..#..^...M../....b..A...B.F.A.A.^g..~x.m^.>7."....x}B........F.|-.}...BH>..m...=#.A..N......m.!$..`6G...\..L....3sB7"..t"..>nU..n.p.&G....!$..@...G.!a.f..F..J.y...x"..^.V..........q.!!... ...]/8..h..iPO......."....
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-fontsize-hovered.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4179
                                                                                                                                                        Entropy (8bit):7.942893504616903
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:Dq5kjYyaAYVIxQkF1AiLZ1NexiPojp3WkJ+iBBBL:DMesVIxQkPzIig93Wq
                                                                                                                                                        MD5:BA726D8E0200BE75DF19278705D16F6B
                                                                                                                                                        SHA1:90290E095F5F795B5BE39F3423B2690866AAD5C0
                                                                                                                                                        SHA-256:7B28F3F46E4886B47C65ED67B01CB5798D2F7DC4FF4DB7BD047E35E3472ABC0E
                                                                                                                                                        SHA-512:92262CA896E3C1ED9240B236E3D65A02997A13D21164AA902DC2B01E464C196EA1337E4BEBE3CF5B10C30FB25C4E9E5BB00E223027219C6386E4383FEED328B5
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs.........j......tEXtSoftware.paint.net 4.0.19..d....IDATx^..SE..Q9..T....s.u.W-T..DED..].....t`..$/.... *.r.....L&....w...P3y=.K&.....[.............%.<x.......<x......Cl.8]n......W.!u......`..}3D8.Z&.?c.....v.P.).vN..<T.)[...Xv.l.p.......xFF3.2p.I-.C5.}L...z..0...c.C2....j.>.I./.d..1........#.A-.[.C.o....F.V.x~..J..b=..r?.Jm ...~4..GpC.....=T......\K.-.L..c.6..{n.-|.=....L...j0E(.....p.SE.{.F;n2f-.......dK...@.......^<m2fML.;..bo..n..h m|...h..T+$Q8i|f ..'..J..... .9...0>3...%...u3.LP........K..M..<P..? C..!ts.J..~DF.;...VI.....L.s....d[2^.O7.."..A8d4.p..x~5..u........_....n..p..Q.z.b.....bw.<..|u.l*c.`:..Q.n...p.s.R...@X.{.'.|..~..T..D.f..u.nv.0i.S.....M..M.Jxt..x......".....+d,...^..@..`.{.3.!.lT.5.3.6~.m....N.5.1_l=......A..=......fg.j.....Hz...rZ..wb.5..Y...-..OMIG..+...St....A.0.C..M..pz.o..y=n...v...N........^."....e...H.9)..Z......-,P..I..#{(.:.............t*.....GWe.}...>.(.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\scc-fontsize.png
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3202
                                                                                                                                                        Entropy (8bit):7.89996341707749
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:WCuJNAArrHAcjzEr4iQS0sWOtnyq7L4tW778:W1hrHHfER0CpR4t7
                                                                                                                                                        MD5:7846E95EE2757C9421DBE5A4B57CD105
                                                                                                                                                        SHA1:07C091FC1062DB5C15B8E6E24622047E24CA2C44
                                                                                                                                                        SHA-256:46BA0C5A3C5230F17CE61A2F6A30B4B7E920EA69C1FEC03A298C369F5F271AC2
                                                                                                                                                        SHA-512:C27604D081C9918D9E49663BB1217879D0F9D08E85E6990097C2AAE2E91AB25773FD44DA1C827B72A9CFC450ED6E8E687F095172509C4A546C13A2089B30839F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR...`...`......w8....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.19..d....IDATx^.........c^`)i F..V[...1.j...@...R!.BT...k.7...^v.Ep.EA*/Yh5..{......X..-6}..V....;s.....w.s3_.K.....7..9.3...(...(z...=......E.....{@..=....P.p.(z...=......E.....{@..!......F~.....)...T....|..It.....P,d.p.q9.8b.[l.._.@.P..:FI..a'......g.@.P...$G.p'..iQ........(.*........b.......\.b.".}@...v...%.o.@..!. ..;....s~.|........_l-G.......y.\a....B.l.....S..fE....c..P.fC.Q....BC.5.....:.:.../J6...l(.I.q;...B#p.c5r.$.a...[.B......p.i...v.....\{T.{Q.2.E;?.....&..."..51..4j'..XHp..V.....44./RAf.i.N.2.hQ..\..j+..XHH...Y...&Ut....V..|(..*4...&.=.@.P....D\....#S$..4...~.&...X6.;....Fm:... ....X.a......Q......x...4...Z.r...w.Fm:...B..q..y...z.EpB.b...)......*..Ae.H...<h0j..P......}0....T....;b....YL.S{]c.3......x.4....-b..$.T.mb...z........~.D.Yn.^9...M...I........jQ.N.b6.7.'......]..n9....R........{..>.n../.....{u.gCP...M.]..n..v.'...1.P.|B
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\secure.ini
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4216
                                                                                                                                                        Entropy (8bit):0.38302964491995645
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:1YNUP0odAVsssssssssssssssssssssssssssssssssssssssssssssssssssssR:1UiVdb
                                                                                                                                                        MD5:58BD782A6B3A8FC68E6064F4C8258939
                                                                                                                                                        SHA1:C42D2AA6EC16A13080DE92E4CEDE1390AEC3FCAB
                                                                                                                                                        SHA-256:6F4B57D62DA65288EF1E0AD9E2D0117462369FFD8F418717B77F4B0DE1F8D45F
                                                                                                                                                        SHA-512:A4B56BBDE8A7F9F2386317BAB892E38A93309DD945B2DB9A515F71B201EF7ED1381BEAFF7FB6E6B429588232A7716FC9046ADF7B3FAF2A91CB1C46DAF9C444D4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [General]..sessionKey=621918d0f847948c7990a09552913d77.. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\server.lic
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8372
                                                                                                                                                        Entropy (8bit):7.972897807310122
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:R/SRV5s9YqnZwmNP89jF0kQb6JO3Bhs/VTpMjMWXAuH:R6e9/n6d0kQmJ+jeVdsH
                                                                                                                                                        MD5:380AF59F58B962BA5EEC38A13EF5B88E
                                                                                                                                                        SHA1:797B1492BA7FFA4FAA9E5FBB9B5000CB13482769
                                                                                                                                                        SHA-256:D6604268C16F8A9232E1EE4BE16ED42BADF18AB0FE9FD12416358200E1BB7933
                                                                                                                                                        SHA-512:F59815578FE88287363DB7EB082C7D9AC5745072E798DB5CB6A64543E28510744AEC3D116678112DC90717399D43D6D3B3897D8735421EBBD479C5E0748CD02B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: Bomgar Software License v09.11......j...4.Fu.l..M..f..N...<k...Gx.B...z.4.muf`p5W...Cz.y7I.2..]M...W%.<.*....D....K5.Y....+.E.E.F.`..j....a..fIfW.4..YF0..8..@.3[.+RP....8.WFw.........G.....A....G....k..$...5.si.....t... ...Hg`...6..k(. $&y.ip.~K.........b...M....Q..h...Z../..*......c-ZO...s.Jt.)KM.wc{U....,c.j...c.......P....aAi.,.......y..2..M.9..ufJ.7...PA.(.... .B.+...........f.`......[$...U$..:...6[..'r..QZ...Lg-.E.-OM{l.O....+.@..^iz._s..D..>."...U..;.X./SrTL.!.M.]."r.#.)k..y%.......~w(5..2.ZGO}:.)......^.|N..n..`...h6d\li..G.z..$q~.....<.<.+.@I}$.s....F.N.........;g/.p.....s.4..?$....]..uV.^Q|/g^'..{.._.Hy._-d..a.*...^..{.[..!.F......s..f....D.A.*2.k`n.B....rb#O.c...r#o..<.nN.;.=.c.#J..x.%.<L!.2.."..y..8..x..#.R=..b"8.m.... F&TT._..uu......"P.W.M..I............ozbK...#....Pj6.Qa._..`.......m..;..7.7.".(...E..^.T.....(..8*..W.`.-,r.....4.......y...jKE/e..P..eK.#.e .............7X...&...>).."...".GA.X.S.@c...9 ...Wv...\.:.Nu.[iF......N.%..,
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\settings-cc.ini
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):20964
                                                                                                                                                        Entropy (8bit):0.6158930177429326
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:1Pi28QV3EsBW28bV3EsBHb28WV3EsBH1xu+28JV3EsBH1xu+28FOGm:1K2KsBW23sB72ssBbp2BsBbp2j
                                                                                                                                                        MD5:66CC9A289384CE81608A5B37D2D1F5DE
                                                                                                                                                        SHA1:286EA5C11F2212BDAD1C816C365E5BC829263090
                                                                                                                                                        SHA-256:E09DF26F34DD39F5A58AEC8FBA92C3A496009B678152E3769F31CE83C544697B
                                                                                                                                                        SHA-512:FF03252741FABA73DABAFBE659FCB5F150DC3C3F03D4246485C1E7113C41D4B88BC74899C565B377A2E27720C13F038019C9A55C1907E452F01B61ADB8799AE6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [General]..build_date=20210527105824..instanceID=60F9EE75.. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\settings-init.ini
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):289
                                                                                                                                                        Entropy (8bit):5.115636515741141
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:1InLkQzUTsXRN4CNVTJ4DG7r6KSX0wJ8C+g5KMJPzy:1OgQzUTsBG2VTJ4avLmCUKMdzy
                                                                                                                                                        MD5:34C343BF7EBE6122E78ABED651C11D8C
                                                                                                                                                        SHA1:46129E6808F461162B9687BB03DD1A2C82F8B3CC
                                                                                                                                                        SHA-256:461D3E12F01329F59F8C973885B9BC4FBC9445C86520B4A852EC33F0238AF94D
                                                                                                                                                        SHA-512:89C9E71EA2BD271D77F564994B18252EE80E497B10D1BF28AB43FEAF56BE971882112892E8191184D6EF7C8B71F43611D24972E333D7938DAF479EBD3D823F53
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [General]..build_version=21.1.2..build_revision=46837-6e088c415ffb1d6a800fb6c268869947b60a64b6..build_date=20210527105824..startup_animation_instance_id=$SPIN_INSTANCE..[Reconnect]..min_reconnect_delay=5..average_connections_per_second=50..respawn_interval=60..proxy_detect_interval=1440..
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\settings.ini
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:UTF-8 Unicode text, with CRLF line terminators
                                                                                                                                                        Category:modified
                                                                                                                                                        Size (bytes):330929
                                                                                                                                                        Entropy (8bit):2.8848691395726185
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:NCHtWgGCHtWgGCHtWgGCHtWgGCHtWgGCHtWgGCHtWfNCHtWgGCHtWnNCHtWnNCHx:MpppppphpRRpKxqapHQ
                                                                                                                                                        MD5:0FE5D14DE43E22A0EDFEFD9F7CEC4F85
                                                                                                                                                        SHA1:471043AA20B570089E613B0B754A6D9939B15AEB
                                                                                                                                                        SHA-256:C44DE724D48996EE87AF26EEC9365958ABFE65E1BBE099A21593900E2566F3A4
                                                                                                                                                        SHA-512:0039428B36D8C222F8B256F0019662ED65D389981ADE399C5C0D9FA68319B0B24F8AF761B880BDEA1525736C153AF98530E9BC4EB619980E93A1C5B86D20CA7F
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: [General]..build_date=20210527105824..build_revision="46837-6e088c415ffb1d6a800fb6c268869947b60a64b6"..build_version="21.1.2"..drone_heartbeat=1626992281..elevationMode=2..elevationRequester=..elevationRespawn=..elevationSuccess=1..install_dir="C:\ProgramData\bomgar-scc-0x60f9ee75\"..instanceID=60F9EE75..online_heartbeat=1626992274..quietUi=0..saved_orig_installer="C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe"..sessionKeyType=0..silentElevationAttempt=1..spawnedSessionUPID="5072:c4bb151cad99b933261b8e9d5593cc3e"..startup_animation_instance_id="$SPIN_INSTANCE"..touched=1..useDroneMode=1..[Pinned]..AppPath="C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe"..autoupdate_use_app_res_dir=..build_date=20210527105824..build_revision="46837-6e088c415ffb1d6a800fb6c268869947b60a64b6"..build_version="21.1.2"..instanceID=60F9EE7A..[Proxy]..detect_failed=0..version=2..[Proxy\ConnectionEvents\remote.oracleindustry.com:443;remote.oracleindustry.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\spinner.exe
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):254200
                                                                                                                                                        Entropy (8bit):5.4490244515538935
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:aT5872UpzxlNjI+s4A8dsTNlEMUshg+tPreAPPghXdlbW6JJJgYXFOXt8/cEhhEF:KSPphzs4Amsj9ztjjVK0EhA
                                                                                                                                                        MD5:D62E71AC7C38F629B101FD06A8FFFBDA
                                                                                                                                                        SHA1:946F8C321F927F882C3AC8B16EA5D6491F72EF00
                                                                                                                                                        SHA-256:78EA456835E63E23C01AEBF7EE53B3AC790A4D8CB8CA20B1A388B54A5CE44D1F
                                                                                                                                                        SHA-512:4E32FD619F24EA98FEEC46B4E8B841A5F23CD52E3F22EA6B2BF030B5ADAA5893BE67995B5B7ABA2C9FC11D2EB01051EF8D70A132B331D30F6095F58CDF22B155
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)-'.mLI.mLI.mLI.y'M.fLI.y'J.hLI.y'L..LI..<L.HLI..<M.}LI..<J.dLI.y'H.dLI.mLH..LI..=L.oLI..=..lLI..=K.lLI.RichmLI.........PE..d...*P>`.........."..................".........@..........................................`..................................................\..d........9......D........4......8...pL..T............................L..0............................................text............................... ..`.rdata..~...........................@..@.data........p.......P..............@....pdata..D............Z..............@..@_RDATA...............h..............@..@.rsrc....9.......:...j..............@..@.reloc..8...........................@..B................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\start-cb-hook.bat
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1403
                                                                                                                                                        Entropy (8bit):5.568486223574158
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:C3vx4Oe5KVyP8ggpdmfciaLUcGLifJkpfBrdwpE7Yic7Bk5C5HfjZn7ZWgn:C3uL0VyPYkfc3DG2ujd57Yv7Bk5CZ9n
                                                                                                                                                        MD5:3BE907A6BA81359F4CBEC331B7D6FC0C
                                                                                                                                                        SHA1:9B492B01D15058EE41AE1743632613A938CF97F5
                                                                                                                                                        SHA-256:6DFD834C976BF37764234C4511CCE887E0666584D879543385442EE6F9E76402
                                                                                                                                                        SHA-512:906A91301A42C0BD83FB401515C103E2219A9452E5FC8818F2977B1AE3BBE8CF96954DA3E50AF80CB6D0796C219D558C6AC28AF7AA46FC4BE44973A206728993
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: @echo off..rem start-cb-hook.bat copies the hook dlls to a different directory and gives them unique names...rem start-cb-hook.bat creates stop-cb-hook.bat with these and appends stop-cb-hook.bat.template to it.....VERIFY OTHER 2>nul..SETLOCAL ENABLEEXTENSIONS..IF ERRORLEVEL 1 EXIT /B 1....set ARGS=%*..set EXE_PATH32="%~dp0embedhook-x86.exe"..set EXE_PATH64="%~dp0embedhook-x64.exe"..set TEMPPREFIX=Z@H!....set TEMPHASH=%RANDOM%%RANDOM%%RANDOM%%RANDOM%%TIME:~9,2%......IF DEFINED LOCALAPPDATA (.. set TMPPATH=%LOCALAPPDATA%..) ELSE (.. set TMPPATH=%APPDATA%..)..del /q %TMPPATH%\%TEMPPREFIX%*.tmp....set DLL_PATH32=%TMPPATH%\%TEMPPREFIX%-%TEMPHASH%-32.tmp....copy /b "\\?\%~dp0cbhook-x86.dll" "%DLL_PATH32%" ..start "" %EXE_PATH32% --install "%DLL_PATH32%" %ARGS%....rem write over any existing stop-cb-hook.bat..@echo @set DLL_PATH32=%DLL_PATH32% > "%~dp0stop-cb-hook.bat"....set x64=false....if DEFINED PROCESSOR_ARCHITEW6432 set x64=true..if %PROCESSOR_ARCHITECTURE%==AMD64 set x64=true..if
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\startup_animation_1.bmp
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 300 x 200 x 8
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):61078
                                                                                                                                                        Entropy (8bit):1.1563480973349343
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:saMelmOKEoyAbKxhRCeOXaXF6kCslD6XnXvHX5/1lMO3XHoX5HIlttINM0+FN:bmO37AsRwXaX1/0tMKHoulvvx
                                                                                                                                                        MD5:7604363A3DB0D8202ABFD9C16D154D4E
                                                                                                                                                        SHA1:6BBA587D800DF3630C1A762422B743B8F8D91086
                                                                                                                                                        SHA-256:D732DD994C232E710145E43062E5E085E3897B885ACFB5422B6C395E3295042D
                                                                                                                                                        SHA-512:1DD47A4EAEEE8EBFF4A661FEC6943D2D3A59E9C37E90120078FAAF90AD92C4C973F8B1526FDAD20CE4D770220EF49D8EEADFD7AADAAADB1B9057602969229033
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BM........6...(...,...............................................(((.666.QQQ.b`_.\cs.fdc.igg.`dm.mkk.lll.pnm.qon.vtt.xvv..~}.?e..\j..[l..Ne..Jf..[q..`~..*c...[...U...U...V...W...X...Y...^..p...z.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\startup_animation_2.bmp
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 300 x 200 x 8
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):61078
                                                                                                                                                        Entropy (8bit):1.161308355433604
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:uIKaO37AHIvxIbCrOxRsLOL7LYQb2aQ4IVIe:TKaO3+IKbCrOxRAaQ4s
                                                                                                                                                        MD5:0B312FD112C34504680ABCE9FE6EAA13
                                                                                                                                                        SHA1:3268FFD8504801A59AB5722A174498691419DDC7
                                                                                                                                                        SHA-256:EB3FF2CACD409461C6A8DDE65D278C296745401FAFFFD6ECDCF470E595C98008
                                                                                                                                                        SHA-512:2289EE101AF9736320D27FED8DD52F2954DF98208E8B84358BF6468988B714CF6894188945CE477EA43017B250C1B2C8B73F3363FDE560575CE4832B8CFC0519
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BM........6...(...,...............................................(((.666.QQQ.b`_.U_t.X_p.P^}._`e.fdc.igg.`dm.mkk.lll.pnm.qon.vtt.xvv..~}.3[..,Z..C]..\j..[l..[q..`~...X..$Y..!Y...W...W...V...W...V...V...V...U...U...U..p...z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\startup_animation_3.bmp
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 300 x 200 x 8
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):61078
                                                                                                                                                        Entropy (8bit):1.161308355433604
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:uIKaO37AHIvxQ0b1AJRKL8LpLY2Z2oK4urIe:TKaO3+Ii0b1AJR2oK4E
                                                                                                                                                        MD5:915B8A9DE4CCEF690B17A5A66B945487
                                                                                                                                                        SHA1:9A3D393A91F551446561F8E42E90C0E13C1EB4FC
                                                                                                                                                        SHA-256:BD8E3F9CCF7F108DEFDF28C74D238AFA01BD22F119A782497C1FFDCDB0CD0CC8
                                                                                                                                                        SHA-512:16DF0E7DC2577FABB2592F514E83574404951BB2A702100238F71E69FAD2E48385B6B1E33C981B028AC6E76B076B1CEF1A57D9D9D2FB030D57465E46E2CFA5C4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BM........6...(...,...............................................(((.666.QQQ.b`_.U_t.X_p.P^}._`e.fdc.igg.`dm.mkk.lll.pnm.qon.vtt.xvv..~}.3[..,Z..C]..\j..[l..[q..`~...X..$Y..!Y...W...W...V...W...V...V...V...U...U...U..p...z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\startup_animation_4.bmp
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 300 x 200 x 8
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):61078
                                                                                                                                                        Entropy (8bit):1.1509748470400782
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:uRXkw3/oofUGXjSjSjkjXWWPiBIg72wCbIFcbjobjiT6:Uh3SWWPiBIg72IFcbjobjb
                                                                                                                                                        MD5:EBCFFEA1A5E062435B12BAFA37509C9D
                                                                                                                                                        SHA1:90D95C3E42901A47CCEBF9038D629D58D6BFEAA3
                                                                                                                                                        SHA-256:B41EF27CDCDC734B675F6A057D0130DB083B232C1456DF89F6B29DDCF2E01C45
                                                                                                                                                        SHA-512:4DFA9ED7D9C19D06E5D60E036C85658C6CD8EA75CBE08F2BAAD8125E3D3073925CC1E071FF74E4EB1A3EECBD40F94D5DE57ABF6349182DD69E387748E0B31A56
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BM........6...(...,...............................................(((.666.QQQ.b`_.U_t.X_p.P^}._`e.fdc.igg.mkk.lll.pnm.qon.vtt.xvv..~}.1[..,Z..C]...X...X..$Y...W...V...W...V...W...V...V...U...U...V...U................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\startup_animation_5.bmp
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 300 x 200 x 8
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):61078
                                                                                                                                                        Entropy (8bit):1.1484087593385348
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24:saO/CogtALKE/KRkKVststshsniSiSGSZHTFZbL1:uhF3/ZSSunzzfZzt
                                                                                                                                                        MD5:0DB01E512C8B09FEA1C1BCB93DDF0650
                                                                                                                                                        SHA1:75147C7D7256CB4EF2D928BE90A2136171A3B805
                                                                                                                                                        SHA-256:B42445F9D216CDEEBB1463F018616AB955FEF00B3F86548D88910CF60C7B5DE8
                                                                                                                                                        SHA-512:DC89F30EF3D04BDEA271375CFB5415C08F3CB6B9E72837A9077AF5C6CD76E14F0D219D227D92C74C0DADAEB16ABCE9F8861BF607B5E2757D77CAAEAEB5E9E693
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: BM........6...(...,...............................................(((.666.QQQ.b`_.U_t.X_p.P^}._`e.fdc.igg.mkk.lll.pnm.qon.vtt.xvv..~}.3[..,Z..C]...X..$Y..!Y...W...W...V...W...V...V...V...U...U...U....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\stop-cb-hook.bat.template
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):519
                                                                                                                                                        Entropy (8bit):5.454910701231489
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:cNXKIkJWj2diIk3NmyOYV9hI20STt27Sm3hFc7BThH/hO8+:U1iyOeM20STE7xFc7BdpO8+
                                                                                                                                                        MD5:3BF7A702E700E6FBB202DDF6C15D826D
                                                                                                                                                        SHA1:AFE2495765BC7FF7F651744CD7DE95A4D594C878
                                                                                                                                                        SHA-256:00E023342653F09F87000879C3878A5A2FBCD729FD62330399A3EA693F72AFCF
                                                                                                                                                        SHA-512:AB01F5CCA27ED73B1B1E3D7242C2DDFD54FC8BE8C2196FFCED634E85587F0A88273EC323B278955BEB8CA156178FB5ED207944C3080B2A8A10B03F0C53EBED9B
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: @echo off..rem this a template used to make stop-cb-hook.bat. First write @set DLL_PATH32|64 = <path to dll> to stop-cb-hook.bat..rem then append this file...VERIFY OTHER 2>nul..SETLOCAL ENABLEEXTENSIONS..IF ERRORLEVEL 1 EXIT /B 1....start "" "%~dp0embedhook-x86.exe" --kill "%DLL_PATH32%" --site %1....if DEFINED PROCESSOR_ARCHITEW6432 call :killx64hook..if %PROCESSOR_ARCHITECTURE%==AMD64 call :killx64hook....goto :eof....:killx64hook..start "" "%~dp0embedhook-x64.exe" --kill "%DLL_PATH64%" --site %1..goto :eof....
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\uninstall.bat
                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):53
                                                                                                                                                        Entropy (8bit):4.51963554857626
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:D/GjIWtAdASH5Mv:L/d/mv
                                                                                                                                                        MD5:CDD19A0D84C85F3449989EAB0BEC0666
                                                                                                                                                        SHA1:8E41A62581F879339B83DFC7C84DCF373E86849D
                                                                                                                                                        SHA-256:8F77C6A9CE46A37C80E3CFABFFEDCB17F82B5B6E8135F0FD2F40B6E91F6AEF58
                                                                                                                                                        SHA-512:85DD96D2E00CFDB5DF2EA695EFC34E3EE5E907DE92147DB6EAC3B184A470363F54AC17748907F9CB6963E8FD4346B7177C01527A8A88EE5CA780B7622BCD73A0
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: cd "%~dp0.."."%~dp0bomgar-scc.exe" -uninstall silent.
                                                                                                                                                        C:\ProgramData\bomgar-scc-0x60f9ee75\watermark.png.n$t
                                                                                                                                                        Process:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3344
                                                                                                                                                        Entropy (8bit):7.8304293298203
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:dMF/HADAqM1LgxRNvPb4AqpXLJ80BA015rwaN:dMF/eA/LgyAqpXhF15rxN
                                                                                                                                                        MD5:5D11C5C8B7281C6E03DC5D03B9AD866B
                                                                                                                                                        SHA1:B01B4124A7982190666B5EA8BBE5E7D4E6ABF42A
                                                                                                                                                        SHA-256:434BAEE554CA3E0BEEC0F939D0D70C26EC8B02A99CCCC7A7B17E100BB5654C02
                                                                                                                                                        SHA-512:9855BAA2D268D2C878FE05A344315198C1E1965C2E8C206660BD8EA9F724A4ED4D4C9422590EB3C43A83713302A485856DBC04A7F37B302A2278A32706374C37
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .PNG........IHDR..............>a.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs...........~.....IDATx....8....:.y...7h..=.@.'.........r.`|.`.i'.U<.5..`'] .....@....H.-..UQM..%...9.,.......h<.0.......+....0{............|m..&.u]....0..5#.#..n...v.T.s..+<..........k-D'.P0......HX....1.Z...x.a..\.,....<...2Z'..h...B...v~...h...r...."..@..!.w.l....EB....1.)...U.P.?C}M}...p....:..1vP|.>an..l..V.0..=.+..s.........Z)....fE..0..54...h<.....V8..Y...p..0..~...&...(.OP..Z.g...X...*[#...>B.f...i....e. ........6......h.W...x....zt.].u.6.P...k.;k..z../.....z.E...&...^ ..Z.l..B...p...d..e\.d...j_@..x!.D..x...d&.cT....C..D&..v..q.1..ZWFE`L.......FC..Q!4..T.`D.4+...m...D!..`4......O&Z....h....I.._...8...R....A%.h..6o....*.@[...d...5...4.O6.<.z........:.!..#.-......r.......&.(...=.h.3.&.".L.QB....5...s.7..O.........x........`.H..a#6l..L....g|sP]..u+.l...P....1.y7.3...T..k...3....}g&.....3..3.};1~.j3c.b.I...ag;#*l..d0...o.8..:."...
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):120
                                                                                                                                                        Entropy (8bit):3.254162526001658
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:FkXft0xE1G1mstft0xE1G1mstft0xE1n:+ftIE1G1mkftIE1G1mkftIE1n
                                                                                                                                                        MD5:E9224A19341F2979669144B01332DF59
                                                                                                                                                        SHA1:F7F760C7104457DF463306A7F7BAE0142EFCEB5B
                                                                                                                                                        SHA-256:47DD519C226D23F203ACAE0EC44DF9BB6208828E24F726E1602EA52F63C3E2BE
                                                                                                                                                        SHA-512:4184302DEB5009D767FECFC150F580DD57D5CF9CF3BFEB7E52C9F3340E5E6499251B9F0DFF37F0454411FED9046880E0A9204312D021294256372C916B8155AC
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: sdPC....................s}.....M..2.!..%sdPC....................s}.....M..2.!..%sdPC....................s}.....M..2.!..%
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\648edb9f-7443-4f11-8655-6fd4fb8bda36.tmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5074
                                                                                                                                                        Entropy (8bit):4.980093906528361
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:no7YlaMpcKIhok0JCKL8yk+1+bOTQVuwn:no7ZMpcO4Kpk+y
                                                                                                                                                        MD5:7F987E1024B6111B108558A0F7FCED6E
                                                                                                                                                        SHA1:AC351C1A762E0B312E7FF50342EE2CD2907ABCFB
                                                                                                                                                        SHA-256:1D798D482FB631A8B5B1FE344EBFAE1621727EE17B74E354F9577C3F61D4C26A
                                                                                                                                                        SHA-512:2C461AB1A1FCB76D036BE42F009F77BC6D8AA9C9509C2FFD2F335BBB987B7342963E5C80E0C0CF365E3591C1773D5A768E623EC79E7AA068B7BEA7D473367F22
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"account_id_migration_state":2,"account_tracker_service_last_update":"13271465948570404","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245951485614034","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355378"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0",
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8c5dad61-39db-413b-81a8-f962faa42543.tmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):15600
                                                                                                                                                        Entropy (8bit):5.603135796136145
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:rbtfLloBXR1kXqKf/pUZNCgVLH2HfD6rUL3y4X:xLlUR1kXqKf/pUZNCgVLH2HfmrULyY
                                                                                                                                                        MD5:A61CECBDCF41A1B4228BEB178879ECC6
                                                                                                                                                        SHA1:2CEE92271F14637E7B1B3B3CE7B14359161E9017
                                                                                                                                                        SHA-256:7133E766929FFFEBBB5942C0973612F9D35259FECB1B59A126FA1C61217F0C95
                                                                                                                                                        SHA-512:99F2A7DD19FFE8295F3FD773CB4A4FD38B39992BF85B3042A77A9630416088E53D4370E9104E09AAA29B2727DDEF0263E3157631D7C398E1D7C6F1AC781B748C
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13271465948260073","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ef9b669-d417-41ad-84ab-2a0086403a28.tmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1
                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:L:L
                                                                                                                                                        MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                        SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                        SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                        SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):334
                                                                                                                                                        Entropy (8bit):5.270858297449817
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxWq2PWXp+N23iKKdK9RXXTZIFUtpBZmwPWuiPkwOWXp+N23iKKdK9RXX5LJ:xva5Kk7XT2FUtpB/PWu+5f5Kk7XVJ
                                                                                                                                                        MD5:C1B14791547E165FB245FFC745CA00AA
                                                                                                                                                        SHA1:9FF8B43E66EF0CC5C0F267563D1BC56FC2A7610E
                                                                                                                                                        SHA-256:BC3F2FDAEA1EB5A5482D4FA94A6104F6D3BBC96898D88229BD0FB1940AA8F5CB
                                                                                                                                                        SHA-512:3F86E4CE93631D778A563AB4D1138E6A50615F986F784964A68CEA9A2774B6D1AB01BD79BF6FCA3C98BD11C60586CFDF3A22D799B9CEF5B16CD0804B19B02541
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.865 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/MANIFEST-000001.2021/07/22-15:19:18.938 14a4 Recovering log #3.2021/07/22-15:19:18.940 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):318
                                                                                                                                                        Entropy (8bit):5.245363649719781
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:m0pq2PWXp+N23iKKdKyDZIFUtpK9ZmwPm+kwOWXp+N23iKKdKyJLJ:Pva5Kk02FUtpK9/Pz5f5KkWJ
                                                                                                                                                        MD5:3794A1FCD7BA9A6248E78B576B381BA2
                                                                                                                                                        SHA1:2DF217384637016528D4FE18185E47682EA12F9C
                                                                                                                                                        SHA-256:9F310C255322569B2ECC119542E1EC112EDA663392CB40EBBE43EC1C813E5E4F
                                                                                                                                                        SHA-512:425D514516CB76F06957792701838BF583049457CB58B1A0BB5A24CC8DADD654A0325B92A27C3B824113A9DFEB67DBC0A4621B31111826893A0935ED0417A3D7
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.517 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/MANIFEST-000001.2021/07/22-15:19:18.526 14a4 Recovering log #3.2021/07/22-15:19:18.620 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\111efdb076e98bfd_0
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):218
                                                                                                                                                        Entropy (8bit):5.427655596978201
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:m1VYSPEO6vuMyYENtgcXW9XqRqh7YpjK6t:m0vDdW1OeV
                                                                                                                                                        MD5:D86BCE4DA8D490CD452EF03ACB20A7FB
                                                                                                                                                        SHA1:43734FF6A2E0DB089492A32A8245A62F56CE23B9
                                                                                                                                                        SHA-256:A96527D7AD912C1FEAE6C9FF7C82BFCFA439BC88820F45BC50B9431F6069D591
                                                                                                                                                        SHA-512:96F91F92AB824C18852DA4D06ADFB65E7D9A07069124BF7704278B588F409B685A798141B34F7A85A64DE7C318B7852C22144AF0A6DA83700B4CE8AA57962A14
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 0\r..m......V...!..r...._keyhttps://login.oracle.com/mysso/sso_loginui/e_moc_lib.js?v=2.0 .https://oracle.com/j...S&/.............~L......*K..'..yk..^.......i..I}`+..A..A..Eo.........].........A..Eo..................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ce218865b315f54e_0
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):215
                                                                                                                                                        Entropy (8bit):5.445646552713988
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:m+lxIVlLA8RzYSPUEGOZ456ECgkWaUVNvagmll/lHCp/l/rSaacGz0q3hHWm+65Z:msQVYSPEO6vdkW/RXWgRtzW71hjK6t
                                                                                                                                                        MD5:2C0CF094DF399F1D232F401F75D6B7B8
                                                                                                                                                        SHA1:9960A518E99F2006872B92FCA14D86E8AFCD9A4C
                                                                                                                                                        SHA-256:2BBE9008B3DEBA1D0715CD1C41E57A9B4C54CCB83901AFBECFEDBBED59499235
                                                                                                                                                        SHA-512:EDC3D142FA8794E658F5F1B7D05569F34896FCCA735E2CAA919B76C2F27C1D303AAE77561FD8574171818BF72517A102025DEEACE4098A0ABE25E3C95EFE754D
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 0\r..m......S...eG......_keyhttps://login.oracle.com/mysso/sso_loginui/jquery.js?v=4.0 .https://oracle.com/.-..S&/.............sL......EZu3..<WgC.@e]2......s...O..p-..A..Eo...................A..Eo..................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e39cec3a492b8897_0
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):212
                                                                                                                                                        Entropy (8bit):5.4669319481811005
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:m+lQxUttLA8RzYSPUEGOZ456ECM7W1VNva951lll/lHCcXRqXrOmbO52MThMmcnf:mwtnYSPEO6vc/RcrtgcXCCmiokWLK6t
                                                                                                                                                        MD5:853C416CF1E27AC926D6B795AF5D3A68
                                                                                                                                                        SHA1:D494826FDA9F59FA8A616C63808B5C229B032F6D
                                                                                                                                                        SHA-256:E7760F4AC85242EF385562BEA8F25C348E93DAC06962FA5CB668C4F9FA778974
                                                                                                                                                        SHA-512:82853AC603E529C521180142EA6EF7AFC443327B6793C440B13B595AE5D37288D107A069A491924AA7726CDCE63606D6928F6AD53CCE7007A34D7AE256E35FD6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 0\r..m......P...2Dq....._keyhttps://login.oracle.com/mysso/sso_loginui/sso.js?v=4.0 .https://oracle.com/....S&/.............~L...........!K..$.nr...w.]:V.0....H.)Q..A..Eo......J............A..Eo..................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fecafc20d136b527_0
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):220
                                                                                                                                                        Entropy (8bit):5.441752252896206
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mDlVYSPEO6v1AZL0lbtgcXUshMQXShm4tbK6t:S6vv1kAVom0
                                                                                                                                                        MD5:9430E264B753E1653B637E5A47E6B2A5
                                                                                                                                                        SHA1:8A2238B58FF70A6AC90EF95673CB1C94A5D8B5FE
                                                                                                                                                        SHA-256:B73D9BA55362A5087E6F5964D99FB3C6263200E2FD409CCAEB73431D66C68C04
                                                                                                                                                        SHA-512:AAE53C6DFC6C4AF038A6AF24F6F35AF013D13685D3326324846A7BA2C9EC872E7BC2A4C735765982F0BD2F02AEEBAC4C5EA906B8082D1D5C662E9D7AD0288FB4
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 0\r..m......X....!7...._keyhttps://login.oracle.com/mysso/sso_loginui/e_sso_check.js?v=8.0 .https://oracle.com/....S&/.............~L.......?..f.l._..nl.^..4e.g..r.x...A..Eo...................A..Eo..................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):5140
                                                                                                                                                        Entropy (8bit):5.554106107727626
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:34d/H+6qbj1UvdWQt6xajvzk6val+MbQNtOnZ6xIqvICoCQZP:3A/H+pbjy0ajvzk6rMbwcnMF7oCQZP
                                                                                                                                                        MD5:254F4803C576F8512133728090C9F2DD
                                                                                                                                                        SHA1:8412159157480B66BD93BEA1C949D2E32B8A522A
                                                                                                                                                        SHA-256:D29B388ADDB18A33993DF011231D686C3C85799C02E288EED027119C30949608
                                                                                                                                                        SHA-512:3B865B9ED73EC4532288ECC75422F495337EDC0B6E37EA3AA68BE1DED9971F79C27178D4D98EA7BB5049674D2F1B792E9FF079458C15EC890B1CBE81519A0D8A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: SNSS....................................................!.............................................1..,.......$...537dcfbc_c70c_48df_b041_7dc814d27962........................S...........................5..0.......&...{524A03AB-861D-4591-9B4E-BDD69F9D425A}..................................................................)...https://login.oracle.com/mysso/signon.jsp.......D...@.......8...................................h.......`.......................................................A.[.....B.[.............................................Z...)...h.t.t.p.s.:././.l.o.g.i.n...o.r.a.c.l.e...c.o.m./.m.y.s.s.o./.s.i.g.n.o.n...j.s.p...............................h.t.t.p.s.:././.l.o.g.i.n...o.r.a.c.l.e...c.o.m./.o.a.m./.s.e.r.v.e.r./.o.b.r.a.r.e.q...c.g.i.?.e.n.c.q.u.e.r.y.%.3.D.L.7.h.r.g.k.u.u.x.v.o.l.v.q.5.j.F.4.0.O.L.a.k.h.%.2.F.7.e.6.U.f.n.i.y.J.H.J.c.1.H.X.Y.F.l.K.2.s.7.c.C.r.m.k.f.s.Z.f.2.b.Q.T.h.o.4.v.J.D.%.2.F.V.k.Z.e.K.P.1.o.J.m.R.q.s.I.m.N.v.q.k.4.3.C.m.V.k.A.Q.Y.6.3.X.W.7.D.v.d.F.3.
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8
                                                                                                                                                        Entropy (8bit):1.8112781244591325
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:3Dtn:3h
                                                                                                                                                        MD5:0686D6159557E1162D04C44240103333
                                                                                                                                                        SHA1:053E9DB58E20A67D1E158E407094359BF61D0639
                                                                                                                                                        SHA-256:3303D5EED881951B0BB52CF1C6BFA758770034D0120C197F9F7A3520B92A86FB
                                                                                                                                                        SHA-512:884C0D3594390E2FC0AEAB05460F0783815170C4B57DB749B8AD9CD10741A5604B7A0F979465C4171AD9C14ED56359A4508B4DE58E794550599AAA261120976C
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: SNSS....
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):38
                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:FQxlXNQxlX:qTCT
                                                                                                                                                        MD5:51A2CBB807F5085530DEC18E45CB8569
                                                                                                                                                        SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                                                                                                                                        SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                                                                                                                                        SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .f.5................f.5...............
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):320
                                                                                                                                                        Entropy (8bit):5.241817998547809
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mW+q2PWXp+N23iKKdK8aPrqIFUtpu6ZmwPeVkwOWXp+N23iKKdK8amLJ:yva5KkL3FUtpT/Pu5f5KkQJ
                                                                                                                                                        MD5:C099D4E27D9220EF1368946DCB7A1FD6
                                                                                                                                                        SHA1:F6E4E383B9AD34110CE1EA89B0D76332AC7632FD
                                                                                                                                                        SHA-256:C8E693269899205102ED424BD361F5E7172DC81D3049700199B6D4B16C04FB87
                                                                                                                                                        SHA-512:32B1608BAC95BD2474F5C40F395AF4A7CB39498DD914F4A61C45F91AB8BEBD735F911ED24025A7137F6CC3F3194900F360DD758A35983B685A963030A0C9295A
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.572 12c8 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/MANIFEST-000001.2021/07/22-15:19:18.622 12c8 Recovering log #3.2021/07/22-15:19:18.658 12c8 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):513
                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
                                                                                                                                                        MD5:C92EABB217D45C77F8D52725AD3758F0
                                                                                                                                                        SHA1:43B422AC002BB445E2E9B2C27D74C27CD70C9975
                                                                                                                                                        SHA-256:388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
                                                                                                                                                        SHA-512:DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):320
                                                                                                                                                        Entropy (8bit):5.249073619965548
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mtBPj39+q2PWXp+N23iKKdK8NIFUtpqbrdF3JZmwPq1UW9VkwOWXp+N23iKKdK8n:qL34va5KkpFUtpadF3J/P2UWD5f5KkqJ
                                                                                                                                                        MD5:F315C06D5790709EDF51495D9AED6837
                                                                                                                                                        SHA1:2483090EE66D7CC2870D3956428A16418A5D1FEA
                                                                                                                                                        SHA-256:117BF142124FC2F80046BC9E2E840EA8102A54A0884EDE822F6663E7A5023939
                                                                                                                                                        SHA-512:C624BC6A43B26C592FD76792538E00B69427627E073EA9D3F08A0BDF97931406DE733D3C95B9688E863472CB9183875E63FC81F31632A0BBAC6FDCC1DDA0F2C9
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:10.904 1368 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/MANIFEST-000001.2021/07/22-15:19:10.906 1368 Recovering log #3.2021/07/22-15:19:10.908 1368 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):11217
                                                                                                                                                        Entropy (8bit):6.069602775336632
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
                                                                                                                                                        MD5:90F880064A42B29CCFF51FE5425BF1A3
                                                                                                                                                        SHA1:6A3CAE3996E9FFF653A1DDF731CED32B2BE2ACBF
                                                                                                                                                        SHA-256:965203D541E442C107DBC6D5B395168123D0397559774BEAE4E5B9ABC44EF268
                                                                                                                                                        SHA-512:D9CBFCD865356F19A57954F8FD952CAF3D31B354112766C41892D1EF40BD2533682D4EC3F4DA0E59A5397364F67A484B45091BA94E6C69ED18AB681403DFD3F3
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"file_hashes":[{"block_hashes":["A+1PYW3V6CJbBuQ7aqrgYhyH3bT8PKyBXp3hN2slpI0=","WSOpQRkYTHjPSlG9Zif2a7TNhy43NDcG1Zg5Nv0UbH0=","jDctR8ImG5KZrQKm4kDjUB7FokSJfjo/pmvFowRVlaY=","LPxhhJiuU0lprt0T6flpS7TkaDg7MocrbmzO65xH6RI=","nZ9zLb2By96AkKXALRM+C0Eu11XUjPiMXEKjiCPdtHE=","wifibc1QfMBN2jrtUtLgsCefvuceTpAatmLvul11RJA=","dHjWlSIIdjj7MWqg3T8MG58RuuqRXk32vqi/13JqEgA=","zd3DV7dbvfNvx1hdhU01fW5ily52DLN0CFL/ADaEeTI=","DpjXcO85FFFY9KJFPkGNfFUtdQIOsGwO5jUckiUwY14=","gqid6l1+mk/6yWgUECRofI9lMipXgXh2jEN2+CxmPE0=","prDB91X2Mmfg/M/txVMITWBmEGbOGjqBTP7CMjYqdHs=","yLPAqV4gqoyS/zFkEt3Cn2j0q2v9QOSthVFfWn8EzCM=","EPQ3jzdrLkAHyvf3920B5Y3aAkO1IJdn/UtbnAmq6T0=","+oOc6ca+ChKUpTu+oa2ZRxRE+wG3QJmuYWEvYCs40NI=","3mBGNAiRlTANEQkqzU3TEi+5wJ0ubR5uwtS4/9OOM7w=","1A9NNawxuhu95H5eThvf1rewJ4QQWhhPNxJXO1C/n68=","E3vWLQxzmj+e5QxYbUscllJ5n0ITpw5JBHV1Kph3/KM=","i3I8ghdTF9c1ZXNBZmvsID+DV4gxBVN27rj9wsMtRpg=","R8B8qYabnMSlLPhrtu0hGYrHn3llsMHqBbi70gkIjEE=","rhlzuEvv2KRAFMms896xFwkNgPrw6WvmgPn6xrBSa2Y=","LAMXv6sRb0VZrY34aVXF3Fftxs
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_1\_metadata\computed_hashes.json
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):23474
                                                                                                                                                        Entropy (8bit):6.059847580419268
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:7dNc1NC6IcafusK4H1IIGRlhKlkIALQWdynQh2RX4K6M1tVztzr7XSNyzH:7dOscSRKc1nGRSkIhEw6M1tf7SNyb
                                                                                                                                                        MD5:6AE2135EA4583C2F06CDEBEA4AE70FA4
                                                                                                                                                        SHA1:DCEB26C7F02D53B5F214305F4C75B4A33A79CDC2
                                                                                                                                                        SHA-256:03AA1944CB3C4F39E20B6361571BC45DFBEBD3FFDA3D8F148CC6ECB29958F903
                                                                                                                                                        SHA-512:B5945E67D9F73DD1982D687E5C6D9B5D6B3886C8050363A259755C76AC0F93651F3425FA7C21AA6A13977AC1C8C9322F998F131648CB8909096058D4F0D23312
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"file_hashes":[{"block_hashes":["DOZdV3jFvk12AM2JNDYKo3KZrIVRprmJ+sVGWkqqE4Q=","rVElW3Hu3T52SzDDUqGT5YiJTBGUv2h3pNuBKFlhZ1U=","X/3fg4KZxgQ1jBr5QGq0F5JnflgE27UErd88mrxTcxs=","VibLbpy0ig+5INMOU71fTYN76iaka2XVpmm1qAKYsX8=","EChCwCbQHbHQ7oDdGT2qNyiRJ0yck2YC2emNGq4whtE="],"block_size":4096,"path":"_locales/iw/messages.json"},{"block_hashes":["xklkoZ7iSU1+7cd6DAtEmUC5lPFd+EgcbnzxkOiFwlk=","3KbsvoxKY/3AwqgF2aAdVQRpMhsNVRkQ3rx2A6Z2Z+Y=","o9+tsohquaCMj+70zeinRG/hBhA2uLoDl/WoC1uokME=","xV/K8xucyWJELVT8Cqn+ugFjobBVmg8pnmACF+2PP4Y=","p/mvJm2wuCl32Rx3it654MljKAsMe3S9IDEabc1A8mE=","j8mPrTb5oOsBTj2Fer78JE6xG6+kR64Cvu2SW8d3j/k=","nqSRpGQ3USU2bZJsZ+AzBmFOyann8omwJrhEWFZDTXc=","eTcQyJUuNuF9yCga/fXGyFCj/pysSceanhBzksdx23s=","Wj7faqnspelXKMvnduxHn1XUBG8TEOqyns7/oUihekM=","VtBwXoadI3EP336rAiL33Gz19KGqtN+RYdKnMKAXoLw=","iDgLXQqXJp8nCZxgLuC9LXM45DGfufvGnXvmHsn18wc=","g+RfdDfrWTUK0Pkcsbot7NJ4SC9wVRV/dVVMuHAtEj8=","2oC4HcCuXu3VjFf6wnKlznt9uqQNaebcuWpm/mWj69U=","aMUIpuFqPMiieSaWhIktCK62v2P3OZQAWupWsYzCnvk=","L
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):14904
                                                                                                                                                        Entropy (8bit):0.047785563130200284
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:eAd/ltlY1l4AS4Pl4Ad9ltl4ARo1l4AfFPl4AQ9ltl4AT4ltl4An:eAIAAS4mAuABAwAQHIAs+An
                                                                                                                                                        MD5:A95846582AE469496817AB195062B5C3
                                                                                                                                                        SHA1:28F399877C04E1525827B2B07433901E10EAD683
                                                                                                                                                        SHA-256:B122635CC09DD9D230F9D6C6CD5CD0963AA9DE8752B271910586CD14E61F8323
                                                                                                                                                        SHA-512:53ABC27B93E6F595A2DF5A69AFDDD7EF07559444EF17A8AA1ED3C4C5AB4C666B8A681CF66333A5BDDB58025142B800E79BA64A58C7AE803195B41DF631079B3E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .............O:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):19
                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:FQxlX:qT
                                                                                                                                                        MD5:0407B455F23E3655661BA46A574CFCA4
                                                                                                                                                        SHA1:855CB7CC8EAC30458B4207614D046CB09EE3A591
                                                                                                                                                        SHA-256:AB5C71347D95F319781DF230012713C7819AC0D69373E8C9A7302CAE3F9A04B7
                                                                                                                                                        SHA-512:3020F7C87DC5201589FA43E03B1591ED8BEB64523B37EB3736557F3AB7D654980FB42284115A69D91DE44204CEFAB751B60466C0EF677608467DE43D41BFB939
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: .f.5...............
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):372
                                                                                                                                                        Entropy (8bit):5.28796929598285
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:m//q2PWXp+N23iKKdK25+Xqx8chI+IFUtpFZmwPsbPkwOWXp+N23iKKdK25+Xqx7:iva5KkTXfchI3FUtpF/Psb5f5KkTXfcF
                                                                                                                                                        MD5:6CCE0CE556D8DD3B6D86C605E6A30920
                                                                                                                                                        SHA1:811FBFAEF34328E95DC5BE87AFF2025035C8FB18
                                                                                                                                                        SHA-256:D71384E2979B8ABF186CC362767714D4E101FC4EF06393212D7DBECABA2E0BC6
                                                                                                                                                        SHA-512:51E3E7BA8743C1DAFEF8BB4A88157724A6C4E3D9D8B323F2D038FE62EBDC53976BCC26A5C4F92ADD39B6A8974EB14CAF528FCEEEB526F94C7BC73CD2D0AC3D13
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.309 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2021/07/22-15:19:18.332 14a4 Recovering log #3.2021/07/22-15:19:18.348 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):358
                                                                                                                                                        Entropy (8bit):5.238549497347149
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mIq2PWXp+N23iKKdK25+XuoIFUtpgZmwPRbkwOWXp+N23iKKdK25+XuxWLJ:Jva5KkTXYFUtpg/PRb5f5KkTXHJ
                                                                                                                                                        MD5:5C0DB8539FF9F4F89B9B8EB151DF1C77
                                                                                                                                                        SHA1:D821A4DD56585A95C6A3C35FC40289F20294B2FC
                                                                                                                                                        SHA-256:38ED274325EFA416DF74121B5F8E732115A0D13ECDFB5E142F8FA463E5F867AD
                                                                                                                                                        SHA-512:B298590F5FA8ECD02C83F9E90E72C6610A6C9C8230FFC434F6D8F3C26A08B915C0800FE0906BFADF7E6DBDEE962A2510F127DDFC41C34279E014E8DB2509D183
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.289 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/MANIFEST-000001.2021/07/22-15:19:18.292 14a4 Recovering log #3.2021/07/22-15:19:18.297 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):330
                                                                                                                                                        Entropy (8bit):5.29345251172928
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mIOq2PWXp+N23iKKdKWT5g1IdqIFUtpDPZmwPmkwOWXp+N23iKKdKWT5g1I3ULJ:BOva5Kkg5gSRFUtpDP/Pm5f5Kkg5gS3e
                                                                                                                                                        MD5:7D9762FD4B555C7E78E0147162E2C36B
                                                                                                                                                        SHA1:562C53ED3FAF887D1B36A363FF6A6209CD851E6F
                                                                                                                                                        SHA-256:911FAFDB7D24DA98E4FF394036B1B3FD22447D9CB5F8C46CF2F2BFC61DCF0B94
                                                                                                                                                        SHA-512:ADB4418E9F58E892092B76736C3820F5D65C6AEF6B9EE3655AEC081D02F8DE9428F78CA39E6F9DDB9E531509BAFF03FDE4841E9EF9E0C787E1587052ADEDEEF8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:17.977 14a4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/MANIFEST-000001.2021/07/22-15:19:18.136 14a4 Recovering log #3.2021/07/22-15:19:18.236 14a4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):3712
                                                                                                                                                        Entropy (8bit):6.331767641120515
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:96:zE9VWLKMpKQVlb94lrwKcU47GICoCQZU43:OMRK2lEStcoCQZ7
                                                                                                                                                        MD5:45B377E02D051945E6E3F033A04CF904
                                                                                                                                                        SHA1:748A3943916BA8A2C5B3EB28C66CD929D2F0BF91
                                                                                                                                                        SHA-256:6FF633B5AC5E5293DBFE7CCF4B75629C554860B0C60F565D17ED4D75DBAFE30D
                                                                                                                                                        SHA-512:99EEA2E930EC012CCE53CD6C17401509B4D951AED85224ADD74196EFE3A1BC66AF1ADF05025692239A097015421B731D9B595B50384DDC565B40F12565EFE0DF
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ..........."...0..com..https..jsp..login..mysso..on..oracle..sign..signon..single.(6e906df6caa57a0814aa268ff3d149259eb8bced..complete. d5ad05e5dd134721bd791679f24ee989..h..l..lsid..m..oracleindustry..remote..sd..sdcust..session..t..dashboard..epmos..faces..support..1.>1mgxng5f1ybnunikbdou8xo68nmqy4hahoanmfbnjsy6bnuol4r3muawl0qvnw..2..2srzgcvqssd..5ssxpeykc.)7e6ufniyjhjc1hxyflk2s7ccrmkfszf2bqtho4vjd..agentid..cgi..corpwebgates..crmethod..ekxllbtk6bwpxfkbchder9w9fb..encquery..gh7tf5..l7hrgkuuxvolvq5jf40olakh.7nerlilyf54j17pm6fwpxafoftxz4mixz1lulph81sfptm0kggjaqmu9..oam..obrareq..server..ver.'vkzekp1ojmrqsimnvqk43cmvkaqy63xw7dvdf34.<ykyczdsludzvmipahzn9eznuzi9gonereq2ufoxeqey3qeasqpgcguygneva*...0....1...B.>1mgxng5f1ybnunikbdou8xo68nmqy4hahoanmfbnjsy6bnuol4r3muawl0qvnw......2......2srzgcvqssd......5ssxpeykc...,.(6e906df6caa57a0814aa268ff3d149259eb8bced...-.)7e6ufniyjhjc1hxyflk2s7ccrmkfszf2bqtho4vjd. ....agentid.!....cgi."....com......complete......corpwebgates.#....crmethod.$.$. d5ad05e
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):29240
                                                                                                                                                        Entropy (8bit):0.026441371367829078
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:vViv3llu/fllPV74lNllPV64fllPV19lNllPV2fFllPV3FfllPV5oFllPN:vVivUVEXV64fVvV2fJVBVgN
                                                                                                                                                        MD5:E8DFD70A883249ABE30D409C04D8CDBB
                                                                                                                                                        SHA1:5CAC19B32718628EA21BAEE52E7799718CF60654
                                                                                                                                                        SHA-256:896AA6D640CE27376C9729152B0DF1E6A4F9BC988910F13249FB0FD0696C4B2D
                                                                                                                                                        SHA-512:53AA2766714B28A5A5ABF24DE0621858E07C429F6AB27AE62EC072CF1E37E9B220126DB377041CE84F1EDBDD094B0A3B16D300A2820D95A5CCA5CD45A67A3A77
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ............7.Th........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):332
                                                                                                                                                        Entropy (8bit):5.220766958326356
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxAz+q2PWXp+N23iKKdK8a2jMGIFUtpKJZXZmwPKtd3VkwOWXp+N23iKKdK8a2jz:wva5Kk8EFUtp8/PsT5f5Kk8bJ
                                                                                                                                                        MD5:11B1EAAFDF6426FCC8029FC92B650447
                                                                                                                                                        SHA1:67073367A9F349B1BF9081E0243C417737DBDFE8
                                                                                                                                                        SHA-256:A51A1AA6E348C02FA51E7CB53361011C2155B37928479CAABEAB8F019EE0B822
                                                                                                                                                        SHA-512:A477FC4F8DB7B45C725D9A4B6A7B8C81ACDF2978F55D39474AF8BAA7F6B851C921593D347B8BBE6C7FD5C209B9DA3D9EB49E7E864B1C28361181195E96860180
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.283 14c8 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2021/07/22-15:19:08.293 14c8 Recovering log #3.2021/07/22-15:19:08.301 14c8 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):331
                                                                                                                                                        Entropy (8bit):5.257808516203445
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxCvF39+q2PWXp+N23iKKdKgXz4rRIFUtpKoSWZmwPKOxVkwOWXp+N23iKKdKgXS:ndN+va5KkgXiuFUtpSW/PNxV5f5KkgXS
                                                                                                                                                        MD5:FA37456C3CF100F3FEC06EABB0BD435E
                                                                                                                                                        SHA1:8A372E07545C6A42F25CEDCAC50090E19CAC86AC
                                                                                                                                                        SHA-256:376A07A9A55BE7C27B6EE5240EE7C6A039FB5EA7EB9F15FC59E53118BCC4FB9A
                                                                                                                                                        SHA-512:A0C3DEBE7E5B96AE1A1A721190D6914A65496FE43381F07B10EAE8F21A6992E6707B802CB9AFE295FFAFA7166EDDB6A527AEFF4F131A07223EC8C90AA8AAFE09
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.652 dec Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/MANIFEST-000001.2021/07/22-15:19:08.661 dec Recovering log #3.2021/07/22-15:19:08.663 dec Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):19
                                                                                                                                                        Entropy (8bit):1.9837406708828553
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:5l:5l
                                                                                                                                                        MD5:E556F26DF3E95C19DBAECA8F5DF0C341
                                                                                                                                                        SHA1:247A89F0557FC3666B5173833DB198B188F3AA2E
                                                                                                                                                        SHA-256:B0A7B19404285905663876774A2176939A6ED75EF3904E44283A125824BD0BF3
                                                                                                                                                        SHA-512:055BC4AB12FEEDF3245EAAF0A0109036909C44E3B69916F8A01E6C8459785317FE75CA6B28F8B339316FC2310D3E5392CD15DBDB0F84016667F304D377444E2E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ..&f...............
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):320
                                                                                                                                                        Entropy (8bit):5.234696372791288
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxCUX9+q2PWXp+N23iKKdKrQMxIFUtpKfJZmwPKf9VkwOWXp+N23iKKdKrQMFLJ:PW4va5KkCFUtpUJ/PUD5f5KktJ
                                                                                                                                                        MD5:EC7771E81C6AE98591E621FFE4CA3C71
                                                                                                                                                        SHA1:EC1A8039CDAAA87AEC3D9D520F5B2DC21D653904
                                                                                                                                                        SHA-256:536984EDC2AA98C7B3E03AE17C5FBCAA8578B231EA99BDFCC63C8C9CA1054E1B
                                                                                                                                                        SHA-512:EF368375D1745C6C5D1E729213A8448EA70E974EEACB9A03DF8318F0B08FB9548F066F59F30C33242E46CBF1EAE8EA4083FA3AC30C190314E2DC57E9159CB936
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.565 1368 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/MANIFEST-000001.2021/07/22-15:19:08.567 1368 Recovering log #3.2021/07/22-15:19:08.567 1368 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):348
                                                                                                                                                        Entropy (8bit):5.202629311366489
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mx0Aq2PWXp+N23iKKdK7Uh2ghZIFUtpK7ZmwPK7VFkwOWXp+N23iKKdK7Uh2gnLJ:Gva5KkIhHh2FUtpk/PGF5f5KkIhHLJ
                                                                                                                                                        MD5:05D13976B88CFB4F4F22191E39F73F17
                                                                                                                                                        SHA1:4ADC0E7A68452B5FD974A9FC8CDAD1EFF642D59B
                                                                                                                                                        SHA-256:6D2B0258E1191FCC993C7381989964E018ABDD14BB73D83112E3C2F6F7E26FFD
                                                                                                                                                        SHA-512:D544101DD85282C2D54F708252732CAF0A6B7656C42696F70CEF454DC9BA76F1B07D276FCC790A26422238A264A77931EB7C6AF6F713E300FA2BE0A8D3B71E58
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.271 14b0 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/MANIFEST-000001.2021/07/22-15:19:08.274 14b0 Recovering log #3.2021/07/22-15:19:08.276 14b0 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\25e80ff8-63f7-4c23-be9b-d14c319f5559.tmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):420
                                                                                                                                                        Entropy (8bit):4.985305467053914
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:YHpoNXR8+eq7JdV5qQlsDHF4xj70PpqQEsDHF4R8HLJ2AVQBR70S7PMVKJw1K3Ky:YHO8sdBsB6MAsBdLJlyH7E4f3K33y
                                                                                                                                                        MD5:C401B619D9D8E0ADABC25A47EE49CFBA
                                                                                                                                                        SHA1:C9D3B816DD3FBCD98E9C0A32CEC7B501EFC0BBDA
                                                                                                                                                        SHA-256:8F5D75F5EF9876E8D30CE477509F735B50C4D87DBEDB433BE8EDBE6D4B3CB82F
                                                                                                                                                        SHA-512:BC12F16CB95CB0AD708C6BBD005EF863A8552613E612F1084086E0F8262752E1B5144D044F0D141CE8462CC33343C36B517A5CC778751680485D8F88FB51B862
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248543490879170","port":443,"protocol_str":"quic"},{"advertised_versions":[73],"expiration":"13248543490879171","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):430
                                                                                                                                                        Entropy (8bit):5.312644773068557
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxOTX9+q2PWXp+N23iKKdKusNpV/2jMGIFUtpKZEF3JZmwPKK9VkwOWXp+N23iK4:5TX4va5KkFFUtpos3J/P1D5f5KkOJ
                                                                                                                                                        MD5:57D3E478A948C8E517A7031184383AB0
                                                                                                                                                        SHA1:1C5E0D4CCC4C5AA401D8985A73B464FE7905EDE2
                                                                                                                                                        SHA-256:A820BDC6C56DF327B3053BD2C46BD8920F26ADE0B0FE627511DC13FF5A2706B6
                                                                                                                                                        SHA-512:255A1FE2B3C9D2B782642BC103488672A2AE4B02C9FFE5E89108A5AF3505D1E004127AAE320290855B4ADFBFC5DB7F87EB60BE1379A92E4318D9BBF19EE347FD
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.582 1368 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/MANIFEST-000001.2021/07/22-15:19:08.584 1368 Recovering log #3.2021/07/22-15:19:08.595 1368 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):432
                                                                                                                                                        Entropy (8bit):5.333187437325761
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxeIq2PWXp+N23iKKdKusNpqz4rRIFUtpKeGZmwPKZlzkwOWXp+N23iKKdKusNpH:wva5KkmiuFUtpnG/PK5f5Kkm2J
                                                                                                                                                        MD5:72E0AF4009C5447FCC3DBA6061688AFB
                                                                                                                                                        SHA1:5896EA844038B87A6206A4F570945EDED8E49B98
                                                                                                                                                        SHA-256:2D0D0EB783F9E6A12DA8F439D58C775F5D7887A8742C166140F93CB21F7A54B6
                                                                                                                                                        SHA-512:861CBAB8463310930593BF124B74F3F349E6E8AE225B4FD4E00261215BEE8B795AE0FB6340631702BDFC539A1799FCC93511B508FA847D77DB7149D449C9EEE6
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.641 1704 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/MANIFEST-000001.2021/07/22-15:19:08.644 1704 Recovering log #3.2021/07/22-15:19:08.653 1704 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):430
                                                                                                                                                        Entropy (8bit):5.254898331097315
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:Vva5KkkGHArBFUtp//P6T5f5KkkGHAryJ:5a5KkkGgPg+f5KkkGga
                                                                                                                                                        MD5:FC4EF3C24D53F310EDBF43E708B54F37
                                                                                                                                                        SHA1:4C5494F86458825AFD01AD1C539A683811BBD950
                                                                                                                                                        SHA-256:276CEFD45182A32D5C49B2FB68A31578F52110467128D17B1B620A60BD46326D
                                                                                                                                                        SHA-512:3D722D2836C84403C4DB8B1BDA510371F5B39B3181846CED2745B73AED892AAC0A51A8BB9BA2042623D9A9838FB5C1B022283221747A009004A1F16283419448
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.566 14c8 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/MANIFEST-000001.2021/07/22-15:19:18.574 14c8 Recovering log #3.2021/07/22-15:19:18.623 14c8 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):432
                                                                                                                                                        Entropy (8bit):5.272396341362218
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12:0va5KkkGHArqiuFUtpC/PV5f5KkkGHArq2J:+a5KkkGgCgcf5KkkGg7
                                                                                                                                                        MD5:E49F662F62970595EBC8D204ED774954
                                                                                                                                                        SHA1:0CE83D0DD28E96120A62C77F0B910BD28F509FC7
                                                                                                                                                        SHA-256:85E3256581F1079C9148BDAF1EC5CE03820219A071DEF9892B7773D37C833D21
                                                                                                                                                        SHA-512:453DC112DE45991216A067B51BE9BE237B92A3DC25F3B356619B9F823A064B8DA0A2C94BF5979A31176ADAD2D6551743B77AB4FF99482DF992F1FB80132A0DFA
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:18.566 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/MANIFEST-000001.2021/07/22-15:19:18.574 16f8 Recovering log #3.2021/07/22-15:19:18.623 16f8 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):38
                                                                                                                                                        Entropy (8bit):1.9837406708828553
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:sgGg:st
                                                                                                                                                        MD5:45A8ECA4E5C4A6B1395080C1B728B6C9
                                                                                                                                                        SHA1:8A97BB0E599775D9A10C0FC53C4EDB29AA4CEB4E
                                                                                                                                                        SHA-256:DB320AB28DFF27CDA0A7F87B82F2F8E61B3178A6DE8503753D76F1172D32E08E
                                                                                                                                                        SHA-512:8EE91A3A1E77459273553F6A776C423A8EE95DB9DCFA897771814B7AD13FD84F06BB2B859F22B6DDA384B39EAA91F1819F170BABED6DA16BDBCF5BCB06CF2124
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ..F..................F................
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):324
                                                                                                                                                        Entropy (8bit):5.279569165692812
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mxD+q2PWXp+N23iKKdKpIFUtpKAvHZZmwPKGZ7VkwOWXp+N23iKKdKa/WLJ:pva5KkmFUtpd5/PPr5f5KkaUJ
                                                                                                                                                        MD5:B3366F42325FD4DDDA21EE8BD3A46DF0
                                                                                                                                                        SHA1:038022C974CCE85A602CC7E4E9A61348FC12EACB
                                                                                                                                                        SHA-256:1ADBC953C3094B3F4A3934277A88D49609D09C42AC800C8A3C5DF528C1722D92
                                                                                                                                                        SHA-512:B838DE900A9D053E11CBCF79390C4A1052742B25A1B5D6FCE0F8AC340DB19030B80EF36631A55AC0129E105358AEDB30F0747DFCD380DE4A714502CDD0EB4642
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:08.277 1348 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2021/07/22-15:19:08.283 1348 Recovering log #3.2021/07/22-15:19:08.285 1348 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:modified
                                                                                                                                                        Size (bytes):402
                                                                                                                                                        Entropy (8bit):5.374321133676901
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:6:mT/+q2PWXp+N23iKKdKks8Y5JKKhdIFUtp8uDZmwP8LVkwOWXp+N23iKKdKks8Yx:MGva5KkkOrsFUtp8M/P8R5f5KkkOrzJ
                                                                                                                                                        MD5:BDC6BD77491D2C22C1D6370FFB89B296
                                                                                                                                                        SHA1:1C3B41E9180DC0F581D3647B332F0605769E82E3
                                                                                                                                                        SHA-256:451F85794F014DA15AD62754B7F6E136495CC8B51DBEED72EDF810971E7B1378
                                                                                                                                                        SHA-512:5F136C8F2CED9BDD18A816F85D68FC6A9969822A9E29C9B4203E8BC878DC7C419981F47F9FFEB9ECAAA0DC5E6B21E188E17BE4ABB353DBB40416765E49CD82B8
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:20.675 14c8 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/MANIFEST-000001.2021/07/22-15:19:20.678 14c8 Recovering log #3.2021/07/22-15:19:20.679 14c8 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm/000003.log .
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Visited Links
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):48
                                                                                                                                                        Entropy (8bit):4.547995052579129
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Jx8patLBe/5v87VJRPOn:J6pU2k7DRPO
                                                                                                                                                        MD5:22B5587D4B35EB3EFEEE67046D59D4B3
                                                                                                                                                        SHA1:C825D9D73A1930AD5C9AB9567CA016EAC59DC4C9
                                                                                                                                                        SHA-256:179D195A6B8E6E118360370F2972D94C3B4C0D1F48D1D1273C3F6331B40B0384
                                                                                                                                                        SHA-512:9CE5C0A1DB651C2C19399E34B260C0C5E97D563AFA0C96324485D7B019F2B28134BBB12C5E37EFDA8ACC37A60729802926AE8561D9B2DEDD2BAF2685E61DA500
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: ......YQ.r.m.......w........b........QE...K.
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c0770052-ebb8-4d8d-903d-17ec77cd69c5.tmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4219
                                                                                                                                                        Entropy (8bit):4.871684703914691
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:48:YXsJjMH+5s7YMHBKsvxMHVzspxMHbsIHt/soBDysKqnsllzMHpDCLsWJMHLsNuMg:RG+ZGJG+GTTD7IGpD+G7Gp2GnG4GVhH
                                                                                                                                                        MD5:EDC4A4E22003A711AEF67FAED28DB603
                                                                                                                                                        SHA1:977E551B9ED5F60D018C030B0B4AA2E33B954556
                                                                                                                                                        SHA-256:DD2C9F43F622F801FCC213CDE8E3E90EF1D0D26665AE675449A94CEC7EB1D453
                                                                                                                                                        SHA-512:84D3930579FD73C7D86144D5CDC636436955BA79759273C740D2D72BC4847F2F7F165BBCA3EB2E4DFB01777D6A5F141623278C1BF74615C5A491092CE3FD1602
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: {"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248543677350473","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543677350474","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31344},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31656},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501454993","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501454994","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":39369},"server":"https://www.googleapis.com","supports_spdy":true},
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):16
                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:1sjgWIV//Rv:1qIFJ
                                                                                                                                                        MD5:6752A1D65B201C13B62EA44016EB221F
                                                                                                                                                        SHA1:58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
                                                                                                                                                        SHA-256:0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
                                                                                                                                                        SHA-512:9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: MANIFEST-000004.
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:ASCII text
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):139
                                                                                                                                                        Entropy (8bit):4.526181045408581
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:tUKIysCK0yZmwv32yshcs0V8s2ysypbs0WGv:mPZmwPGMVv9tv
                                                                                                                                                        MD5:1D2F66B91BC94000D0703A1A14088D03
                                                                                                                                                        SHA1:7C7C575F6135088D65396E14D4A55581BE1FBBF0
                                                                                                                                                        SHA-256:5CD0182578EF55CC25757E9117C3DAE216AFEDF405A5A24DB9DDA0C317AA4450
                                                                                                                                                        SHA-512:1EC55954FA4F333576500C913D6FFF52B1F571BA62F20A430CD9611C619F52463636448CA78E64B5FE5FEEA6FD76510450F4F75EDE1EFE2559943F20C2BECC89
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: 2021/07/22-15:19:17.275 14a4 Recovering log #3.2021/07/22-15:19:17.397 14a4 Delete type=0 #3.2021/07/22-15:19:17.416 14a4 Delete type=3 #2.
                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004
                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        File Type:MPEG-4 LOAS
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):50
                                                                                                                                                        Entropy (8bit):5.028758439731456
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Ukk/vxQRDKIVmt+8jzn:oO7t8n
                                                                                                                                                        MD5:031D6D1E28FE41A9BDCBD8A21DA92DF1
                                                                                                                                                        SHA1:38CEE81CB035A60A23D6E045E5D72116F2A58683
                                                                                                                                                        SHA-256:B51BC53F3C43A5B800A723623C4E56A836367D6E2787C57D71184DF5D24151DA
                                                                                                                                                        SHA-512:E994CD3A8EE3E3CF6304C33DF5B7D6CC8207E0C08D568925AFA9D46D42F6F1A5BDD7261F0FD1FCDF4DF1A173EF4E159EE1DE8125E54EFEE488A1220CE85AF904
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:unknown
                                                                                                                                                        Preview: V........leveldb.BytewiseComparator...#...........

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                        Entropy (8bit):7.997178639907989
                                                                                                                                                        TrID:
                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                        File name:bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
                                                                                                                                                        File size:3613416
                                                                                                                                                        MD5:742e56852d000c82ff2716b995fe0a82
                                                                                                                                                        SHA1:e8521e02bdf3a2d07bd40857d571724270232ddc
                                                                                                                                                        SHA256:9b86d2af5702989a5ab7623cb16b586f03ff5481dca7cd483581825fa7943985
                                                                                                                                                        SHA512:f4b0b9284e53498f9bd67ae1bd1c2c74e39f371ce47376a7e6f48afeeaa7955de8b88d62c371a6ac8a897abf13863e3867b0fbe970e621ca29b48eeb165496c9
                                                                                                                                                        SSDEEP:98304:4vV5EiKPNL3F78dXRjYCQp4b8HgQkUVp1YFR:4d5EiKPNL3+dXRjYZg/UER
                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0(..QF..QF..QF.*^...QF..QG.qQF.*^...QF..rv..QF..W@..QF.Rich.QF.........PE..L...i:.V.................^..........l2.......p....@

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:f8dcdcccece8e8b1

                                                                                                                                                        Static PE Info

                                                                                                                                                        General

                                                                                                                                                        Entrypoint:0x40326c
                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                        Digitally signed:true
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                        Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                                                                                                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                        Time Stamp:0x56FF3A69 [Sat Apr 2 03:20:09 2016 UTC]
                                                                                                                                                        TLS Callbacks:
                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                        OS Version Major:4
                                                                                                                                                        OS Version Minor:0
                                                                                                                                                        File Version Major:4
                                                                                                                                                        File Version Minor:0
                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                        Import Hash:b1a57b635b23ffd553b3fd1e0960b2bd

                                                                                                                                                        Authenticode Signature

                                                                                                                                                        Signature Valid:true
                                                                                                                                                        Signature Issuer:CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
                                                                                                                                                        Signature Validation Error:The operation completed successfully
                                                                                                                                                        Error Number:0
                                                                                                                                                        Not Before, Not After
                                                                                                                                                        • 4/21/2019 5:00:00 PM 5/20/2022 4:59:59 PM
                                                                                                                                                        Subject Chain
                                                                                                                                                        • CN=Bomgar Corporation, OU=Remote Support, O=Bomgar Corporation, L=Ridgeland, S=Mississippi, C=US
                                                                                                                                                        Version:3
                                                                                                                                                        Thumbprint MD5:6889A3851E863F1CCF86478B3F09D788
                                                                                                                                                        Thumbprint SHA-1:6BE4521A89D6B850666CC0448E19C43EA882BF95
                                                                                                                                                        Thumbprint SHA-256:7CE97658E0B03685B121FE2F01C0C60A2A3A4351A8726091DB0DB21A126A1193
                                                                                                                                                        Serial:78A18F5A6A4A79C40520FCBECED3413A
                                                                                                                                                        Instruction
                                                                                                                                                        sub esp, 00000184h
                                                                                                                                                        push ebx
                                                                                                                                                        push ebp
                                                                                                                                                        push esi
                                                                                                                                                        push edi
                                                                                                                                                        xor ebx, ebx
                                                                                                                                                        push 00008001h
                                                                                                                                                        mov dword ptr [esp+20h], ebx
                                                                                                                                                        mov dword ptr [esp+14h], 00409130h
                                                                                                                                                        mov dword ptr [esp+1Ch], ebx
                                                                                                                                                        mov byte ptr [esp+18h], 00000020h
                                                                                                                                                        call dword ptr [004070B4h]
                                                                                                                                                        call dword ptr [004070B0h]
                                                                                                                                                        cmp ax, 00000006h
                                                                                                                                                        je 00007F86B8B141E3h
                                                                                                                                                        push ebx
                                                                                                                                                        call 00007F86B8B16FDCh
                                                                                                                                                        cmp eax, ebx
                                                                                                                                                        je 00007F86B8B141D9h
                                                                                                                                                        push 00000C00h
                                                                                                                                                        call eax
                                                                                                                                                        mov esi, 00407280h
                                                                                                                                                        push esi
                                                                                                                                                        call 00007F86B8B16F58h
                                                                                                                                                        push esi
                                                                                                                                                        call dword ptr [004070ACh]
                                                                                                                                                        lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                        cmp byte ptr [esi], bl
                                                                                                                                                        jne 00007F86B8B141BDh
                                                                                                                                                        push 0000000Dh
                                                                                                                                                        call 00007F86B8B16FB0h
                                                                                                                                                        push 0000000Bh
                                                                                                                                                        call 00007F86B8B16FA9h
                                                                                                                                                        mov dword ptr [00423F64h], eax
                                                                                                                                                        call dword ptr [00407038h]
                                                                                                                                                        push ebx
                                                                                                                                                        call dword ptr [0040726Ch]
                                                                                                                                                        mov dword ptr [00424018h], eax
                                                                                                                                                        push ebx
                                                                                                                                                        lea eax, dword ptr [esp+38h]
                                                                                                                                                        push 00000160h
                                                                                                                                                        push eax
                                                                                                                                                        push ebx
                                                                                                                                                        push 0041F518h
                                                                                                                                                        call dword ptr [0040715Ch]
                                                                                                                                                        push 004091C0h
                                                                                                                                                        push 00423760h
                                                                                                                                                        call 00007F86B8B16BDCh
                                                                                                                                                        call dword ptr [00407108h]
                                                                                                                                                        mov ebp, 0042A000h
                                                                                                                                                        push eax
                                                                                                                                                        push ebp
                                                                                                                                                        call 00007F86B8B16BCAh
                                                                                                                                                        push ebx
                                                                                                                                                        call dword ptr [00407144h]
                                                                                                                                                        Programming Language:
                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804
                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x74180xa0.rdata
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x300000x4158.rsrc
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x36e6c00x3c28
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x70000x27c.rdata
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                        Sections

                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                        .text0x10000x5c740x5e00False0.661402925532data6.41039227486IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                        .rdata0x70000x11960x1200False0.458767361111data5.20373620342IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                        .data0x90000x1b0580x600False0.440104166667data4.13052818063IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                                        .ndata0x250000xb0000x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                        .rsrc0x300000x41580x4200False0.222182765152data3.46637286208IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                        NameRVASizeTypeLanguageCountry
                                                                                                                                                        RT_ICON0x302080x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0EnglishUnited States
                                                                                                                                                        RT_ICON0x327b00x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0EnglishUnited States
                                                                                                                                                        RT_DIALOG0x338580x100dataEnglishUnited States
                                                                                                                                                        RT_DIALOG0x339580x11cdataEnglishUnited States
                                                                                                                                                        RT_DIALOG0x33a780x60dataEnglishUnited States
                                                                                                                                                        RT_GROUP_ICON0x33ad80x22dataEnglishUnited States
                                                                                                                                                        RT_VERSION0x33b000x37cdata
                                                                                                                                                        RT_MANIFEST0x33e800x2d7XML 1.0 document, ASCII text, with very long lines, with no line terminatorsEnglishUnited States
                                                                                                                                                        DLLImport
                                                                                                                                                        KERNEL32.dllGetTickCount, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, SetFileAttributesA, CompareFileTime, SearchPathA, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, Sleep, lstrcmpiA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcatA, GetSystemDirectoryA, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, GetCommandLineA, GetTempPathA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, MultiByteToWideChar, LoadLibraryExA, GetModuleHandleA, FreeLibrary
                                                                                                                                                        USER32.dllSetCursor, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, EndDialog, ScreenToClient, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, GetWindowLongA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, SetTimer, PostQuitMessage, SetWindowLongA, SendMessageTimeoutA, LoadImageA, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, CreateDialogParamA, DestroyWindow, ShowWindow, SetWindowTextA
                                                                                                                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteA
                                                                                                                                                        ADVAPI32.dllRegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                                                                                                                        COMCTL32.dllImageList_AddMasked, ImageList_Destroy, ImageList_Create
                                                                                                                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance
                                                                                                                                                        DescriptionData
                                                                                                                                                        LegalCopyrightCopyright (C) 2002-2021 BeyondTrust Corporation. Redistribution Prohibited. All Rights Reserved.
                                                                                                                                                        FileVersion21.1.2.46837
                                                                                                                                                        CompanyNamebomgar
                                                                                                                                                        ProductNameBeyondTrust Remote Support
                                                                                                                                                        ProductVersion21.1.2 (46837-6e088c415ffb1d6a800fb6c268869947b60a64b6)
                                                                                                                                                        FileDescriptionBeyondTrust Remote Support
                                                                                                                                                        Translation0x0000 0x04e4

                                                                                                                                                        Possible Origin

                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                        EnglishUnited States

                                                                                                                                                        Network Behavior

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        • Total Packets: 97
                                                                                                                                                        • • 8200 undefined
                                                                                                                                                        • • 443 (HTTPS)
                                                                                                                                                        • • 80 (HTTP)
                                                                                                                                                        • • 53 (DNS)
                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jul 22, 2021 15:17:37.807400942 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:37.807472944 CEST497188200192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:37.852514029 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:37.852683067 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:37.859221935 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:37.905782938 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:37.905822992 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:37.905858040 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:37.905951023 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:37.955940962 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.662589073 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.707962990 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:38.708422899 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.754101992 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:38.754260063 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.799628019 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:38.801223040 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:38.801259041 CEST44349717213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:38.804020882 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.811461926 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:38.811649084 CEST49717443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:17:55.327222109 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:17:55.533845901 CEST804973344.224.72.9192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.534106016 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:17:55.540436983 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:17:55.540704012 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:17:55.744390011 CEST804973344.224.72.9192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.763808966 CEST804973344.224.72.9192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.763849020 CEST804973344.224.72.9192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.763936043 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:17:55.764086008 CEST4973380192.168.2.344.224.72.9
                                                                                                                                                        Jul 22, 2021 15:18:02.181968927 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:02.228833914 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.231004953 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:02.234611988 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:02.281096935 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.281147957 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.281182051 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.283041000 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:02.332520008 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.027815104 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.072927952 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.113790989 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.131477118 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.176441908 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.176532030 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.221605062 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.260890007 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.260925055 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.260948896 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.260970116 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.260988951 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.261009932 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.261068106 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.261100054 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.264553070 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.264633894 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.264796019 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.267740965 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.267796040 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.267868996 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.271238089 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.271270037 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.271356106 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.275269985 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.275305986 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.275417089 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.305994034 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.306020975 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.306099892 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.309155941 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.309197903 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.309261084 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.311353922 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.311386108 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.311476946 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.314980984 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.315289021 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.315366030 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.319287062 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.319323063 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.319430113 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.323376894 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.323416948 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.323503017 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.326848030 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.326884985 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.326956987 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.327850103 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.327891111 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.327950954 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.330473900 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.330518007 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.330573082 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.335184097 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.335212946 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.335299969 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        Jul 22, 2021 15:18:03.337644100 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.337780952 CEST44349734213.70.228.167192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:03.337858915 CEST49734443192.168.2.3213.70.228.167
                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jul 22, 2021 15:17:11.080949068 CEST6493853192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:11.142806053 CEST53649388.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:20.423492908 CEST6015253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:20.475337982 CEST53601528.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:21.450587988 CEST5754453192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:21.501137972 CEST53575448.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:23.419600010 CEST5598453192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:23.479330063 CEST53559848.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:24.439825058 CEST6418553192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:24.491741896 CEST53641858.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:25.282550097 CEST6511053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:25.339432955 CEST53651108.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:26.080313921 CEST5836153192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:26.132277012 CEST53583618.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:28.805244923 CEST6349253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:28.862452984 CEST53634928.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:29.757493973 CEST6083153192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:29.806617975 CEST53608318.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:30.576587915 CEST6010053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:30.626455069 CEST53601008.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:33.080538034 CEST5319553192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:33.138622999 CEST53531958.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:37.733495951 CEST4956353192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:37.795080900 CEST53495638.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:40.586916924 CEST5135253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:40.638874054 CEST53513528.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:41.711467981 CEST5934953192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:41.763525963 CEST53593498.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:43.436301947 CEST5756853192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:43.495934010 CEST53575688.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:43.626868963 CEST5054053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:43.684962988 CEST53505408.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:44.271003008 CEST5436653192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:44.328306913 CEST53543668.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:45.134109020 CEST5303453192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:45.183279991 CEST53530348.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:45.636523008 CEST5776253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:45.688268900 CEST53577628.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:48.556730986 CEST5543553192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:48.608918905 CEST53554358.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:49.480062008 CEST5071353192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:49.530546904 CEST53507138.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:51.099220991 CEST5613253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:51.160136938 CEST53561328.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:53.443486929 CEST5898753192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:53.500416994 CEST53589878.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.187866926 CEST5657953192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:55.248600960 CEST53565798.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:17:55.263721943 CEST6063353192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:17:55.324131966 CEST53606338.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.100054026 CEST6493853192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:02.160870075 CEST53649388.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:02.665397882 CEST6194653192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:02.725148916 CEST53619468.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:07.136894941 CEST6491053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:07.194200039 CEST53649108.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:08.486707926 CEST5212353192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:08.552377939 CEST53521238.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:21.359186888 CEST5613053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:21.426198006 CEST53561308.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:26.193522930 CEST5633853192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:26.253473997 CEST53563388.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:57.325195074 CEST5942053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:57.393449068 CEST53594208.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:18:59.634864092 CEST5878453192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:18:59.692146063 CEST53587848.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:12.799011946 CEST5535953192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:12.811274052 CEST5830653192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:12.813728094 CEST6412453192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:12.831754923 CEST4936153192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:12.840425968 CEST6315053192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:12.859040022 CEST53553598.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:12.878778934 CEST53641248.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:12.878864050 CEST53583068.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:12.898107052 CEST53493618.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:12.905216932 CEST53631508.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:13.443226099 CEST5327953192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:13.486001968 CEST5688153192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:13.503429890 CEST53532798.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:13.544608116 CEST53568818.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:13.596338034 CEST5364253192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:13.645740986 CEST53536428.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:13.909086943 CEST5566753192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:13.966093063 CEST53556678.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:16.494342089 CEST6147753192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:16.543337107 CEST6163353192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:16.559104919 CEST53614778.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:16.602013111 CEST53616338.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.037381887 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.099143028 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.099179983 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.099204063 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.100516081 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.101433992 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.101449013 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.175378084 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.176132917 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.176948071 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.193067074 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.193099976 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.193166971 CEST44361634142.250.203.110192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:17.205374956 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.231268883 CEST61634443192.168.2.3142.250.203.110
                                                                                                                                                        Jul 22, 2021 15:19:17.582547903 CEST5594953192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:17.650940895 CEST53559498.8.8.8192.168.2.3
                                                                                                                                                        Jul 22, 2021 15:19:20.274910927 CEST5760153192.168.2.38.8.8.8
                                                                                                                                                        Jul 22, 2021 15:19:20.341150045 CEST53576018.8.8.8192.168.2.3

                                                                                                                                                        DNS Queries

                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                        Jul 22, 2021 15:17:37.733495951 CEST192.168.2.38.8.8.80x985eStandard query (0)remote.oracleindustry.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:17:55.187866926 CEST192.168.2.38.8.8.80xa0feStandard query (0)remote.oracleindustry.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:17:55.263721943 CEST192.168.2.38.8.8.80xddb5Standard query (0)license.bomgar.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:18:02.100054026 CEST192.168.2.38.8.8.80xb97fStandard query (0)remote.oracleindustry.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:18:07.136894941 CEST192.168.2.38.8.8.80x5793Standard query (0)remote.oracleindustry.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.799011946 CEST192.168.2.38.8.8.80xa2d2Standard query (0)remote.oracleindustry.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.811274052 CEST192.168.2.38.8.8.80xc32fStandard query (0)accounts.google.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.831754923 CEST192.168.2.38.8.8.80x48e0Standard query (0)clients2.google.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:13.486001968 CEST192.168.2.38.8.8.80x26d8Standard query (0)support.oracle.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:13.909086943 CEST192.168.2.38.8.8.80xff5fStandard query (0)login.oracle.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:16.543337107 CEST192.168.2.38.8.8.80xa21Standard query (0)www.oracle.comA (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:17.582547903 CEST192.168.2.38.8.8.80x69c1Standard query (0)clients2.googleusercontent.comA (IP address)IN (0x0001)

                                                                                                                                                        DNS Answers

                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                        Jul 22, 2021 15:17:37.795080900 CEST8.8.8.8192.168.2.30x985eNo error (0)remote.oracleindustry.com213.70.228.167A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:17:55.248600960 CEST8.8.8.8192.168.2.30xa0feNo error (0)remote.oracleindustry.com213.70.228.167A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:17:55.324131966 CEST8.8.8.8192.168.2.30xddb5No error (0)license.bomgar.com44.224.72.9A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:18:02.160870075 CEST8.8.8.8192.168.2.30xb97fNo error (0)remote.oracleindustry.com213.70.228.167A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:18:07.194200039 CEST8.8.8.8192.168.2.30x5793No error (0)remote.oracleindustry.com213.70.228.167A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.859040022 CEST8.8.8.8192.168.2.30xa2d2No error (0)remote.oracleindustry.com213.70.228.167A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.878864050 CEST8.8.8.8192.168.2.30xc32fNo error (0)accounts.google.com172.217.168.45A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.898107052 CEST8.8.8.8192.168.2.30x48e0No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:12.898107052 CEST8.8.8.8192.168.2.30x48e0No error (0)clients.l.google.com142.250.203.110A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:13.544608116 CEST8.8.8.8192.168.2.30x26d8No error (0)support.oracle.comsupport.oracle.com.edgekey.netCNAME (Canonical name)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:13.966093063 CEST8.8.8.8192.168.2.30xff5fNo error (0)login.oracle.comlogin.oraclehsd.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:13.966093063 CEST8.8.8.8192.168.2.30xff5fNo error (0)login.oraclehsd.com156.151.58.18A (IP address)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:16.602013111 CEST8.8.8.8192.168.2.30xa21No error (0)www.oracle.comds-www.oracle.com.edgekey.netCNAME (Canonical name)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:17.650940895 CEST8.8.8.8192.168.2.30x69c1No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                        Jul 22, 2021 15:19:17.650940895 CEST8.8.8.8192.168.2.30x69c1No error (0)googlehosted.l.googleusercontent.com142.250.203.97A (IP address)IN (0x0001)

                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                        • license.bomgar.com

                                                                                                                                                        HTTP Packets

                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                        0192.168.2.34973344.224.72.980C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        TimestampkBytes transferredDirectionData
                                                                                                                                                        Jul 22, 2021 15:17:55.540436983 CEST1509OUTGET /?c=eamesupport&v=21.1.2&a=x86_64&g=213.70.228.167&i=scc&O=337117441&o=10.0.17134&r=6e088c415ffb1d6a800fb6c268869947b60a64b6&s=988683&t=Windows%2010%20Pro%20%281803%29 HTTP/1.0
                                                                                                                                                        Host: license.bomgar.com
                                                                                                                                                        Jul 22, 2021 15:17:55.763808966 CEST1510INHTTP/1.1 200 OK
                                                                                                                                                        Server: nginx/1.18.0
                                                                                                                                                        Date: Thu, 22 Jul 2021 13:17:55 GMT
                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                        Connection: close
                                                                                                                                                        Access-Control-Allow-Origin: *


                                                                                                                                                        HTTPS Packets

                                                                                                                                                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                        Jul 22, 2021 15:17:37.905858040 CEST213.70.228.167443192.168.2.349717CN=remote.oracleindustry.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USMon Jan 18 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Tue Jan 11 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,49196-49200-49188-49192-49195-49199-49187-49191-49162-49172-49161-49171-49170-157-49198-49202-49190-49194-61-49197-156-49201-49189-60-49193-49157-53-49167-49156-47-49166-10-175-174-141,0-10-11-13-23,25-24-23-21-19,095a46b0add95900ee35f4359eb14bf4f
                                                                                                                                                        CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:18:02.281182051 CEST213.70.228.167443192.168.2.349734CN=remote.oracleindustry.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USMon Jan 18 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Tue Jan 11 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,49196-49200-49188-49192-49195-49199-49187-49191-49162-49172-49161-49171-49170-157-49198-49202-49190-49194-61-49197-156-49201-49189-60-49193-49157-53-49167-49156-47-49166-10-175-174-141,0-10-11-13-23,25-24-23-21-19,095a46b0add95900ee35f4359eb14bf4f
                                                                                                                                                        CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:18:07.290967941 CEST213.70.228.167443192.168.2.349736CN=remote.oracleindustry.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USMon Jan 18 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Tue Jan 11 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,49196-49200-49188-49192-49195-49199-49187-49191-49162-49172-49161-49171-49170-157-49198-49202-49190-49194-61-49197-156-49201-49189-60-49193-49157-53-49167-49156-47-49166-10-175-174-141,0-10-11-13-23,25-24-23-21-19,095a46b0add95900ee35f4359eb14bf4f
                                                                                                                                                        CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:14.343242884 CEST156.151.58.18443192.168.2.349757CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:14.528434038 CEST156.151.58.18443192.168.2.349758CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:15.687807083 CEST156.151.58.18443192.168.2.349761CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:15.688246012 CEST156.151.58.18443192.168.2.349759CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:15.690953016 CEST156.151.58.18443192.168.2.349760CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030
                                                                                                                                                        Jul 22, 2021 15:19:15.691637039 CEST156.151.58.18443192.168.2.349762CN=login.oracle.com, O=Oracle Corporation, L=Redwood City, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Jan 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020Sun Feb 06 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0b32309a26951912be7dba376398abc3b
                                                                                                                                                        CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu Sep 24 02:00:00 CEST 2020Tue Sep 24 01:59:59 CEST 2030

                                                                                                                                                        Code Manipulations

                                                                                                                                                        Statistics

                                                                                                                                                        Behavior

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        Analysis Process: bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe PID: 4260 Parent PID: 5656

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:17
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe'
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:3613416 bytes
                                                                                                                                                        MD5 hash:742E56852D000C82FF2716B995FE0A82
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Analysis Process: cmd.exe PID: 1236 Parent PID: 4260

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:19
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\start.cmd' '
                                                                                                                                                        Imagebase:0xbd0000
                                                                                                                                                        File size:232960 bytes
                                                                                                                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Analysis Process: conhost.exe PID: 3160 Parent PID: 1236

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:20
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff6b2800000
                                                                                                                                                        File size:625664 bytes
                                                                                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: spinner.exe PID: 6064 Parent PID: 1236

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:20
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpspinner-$SPIN_INSTANCE\spinner.exe' --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON
                                                                                                                                                        Imagebase:0x7ff78ac60000
                                                                                                                                                        File size:254200 bytes
                                                                                                                                                        MD5 hash:D62E71AC7C38F629B101FD06A8FFFBDA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 4608 Parent PID: 4260

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:24
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\bomgar-scc.exe' 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' -install1 'C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe' --installer-pwd 'C:\Users\user\Desktop'
                                                                                                                                                        Imagebase:0x7ff72e280000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 3448 Parent PID: 4608

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:28
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe -install2 C:\Users\user\Desktop\bomgar-scc-w0edc301yf1zhwyyh65ehgf5g877fx1x1118eejc40jc90.exe C:\Users\user\AppData\Local\Temp\nssC2D4.tmpb\ C:\ProgramData\bomgar-scc-0x60f9ee75\ --installer-pwd C:\Users\user\Desktop
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Antivirus matches:
                                                                                                                                                        • Detection: 2%, ReversingLabs
                                                                                                                                                        Reputation:low
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Show Windows behavior

                                                                                                                                                        Registry Activities

                                                                                                                                                        Analysis Process: svchost.exe PID: 6060 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:28
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 2456 Parent PID: 3448

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:34
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -proxydetect
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Analysis Process: svchost.exe PID: 5600 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:40
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Show Windows behavior

                                                                                                                                                        Registry Activities

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 3216 Parent PID: 3448

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:47
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -elevate silent
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low
                                                                                                                                                        Show Windows behavior

                                                                                                                                                        File Activities

                                                                                                                                                        Show Windows behavior

                                                                                                                                                        Registry Activities

                                                                                                                                                        Analysis Process: svchost.exe PID: 6140 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:46
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 5072 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:53
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -service:run
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:low

                                                                                                                                                        Analysis Process: svchost.exe PID: 6024 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:52
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: svchost.exe PID: 4820 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:52
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: svchost.exe PID: 2224 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:53
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: svchost.exe PID: 1328 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:54
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high

                                                                                                                                                        Analysis Process: svchost.exe PID: 5592 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:54
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: SgrmBroker.exe PID: 1392 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:55
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                        Imagebase:0x7ff725cd0000
                                                                                                                                                        File size:163336 bytes
                                                                                                                                                        MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: svchost.exe PID: 244 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:55
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 592 Parent PID: 5072

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:00
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe' -drone
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: svchost.exe PID: 4244 Parent PID: 568

                                                                                                                                                        General

                                                                                                                                                        Start time:15:17:59
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                        Imagebase:0x7ff7488e0000
                                                                                                                                                        File size:51288 bytes
                                                                                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: bomgar-scc.exe PID: 5132 Parent PID: 592

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:12
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\ProgramData\bomgar-scc-0x60f9ee75\bomgar-scc.exe -exec enum_cp 4041902
                                                                                                                                                        Imagebase:0x7ff607960000
                                                                                                                                                        File size:9835560 bytes
                                                                                                                                                        MD5 hash:A72C14740D19970DE5B5F828CF0A72EB
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: regedit.exe PID: 2148 Parent PID: 592

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:21
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\regedit.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\regedit.exe
                                                                                                                                                        Imagebase:0x7ff627af0000
                                                                                                                                                        File size:336384 bytes
                                                                                                                                                        MD5 hash:AC91328EE5CFFBD695CE912F75F876F6
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: mmc.exe PID: 4072 Parent PID: 592

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:21
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\mmc.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\mmc.exe eventvwr.msc /s
                                                                                                                                                        Imagebase:0x7ff764190000
                                                                                                                                                        File size:1859584 bytes
                                                                                                                                                        MD5 hash:BA80301974CC8C4FB9F3F9DDB5905C30
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: rstrui.exe PID: 4276 Parent PID: 592

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:22
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\rstrui.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\rstrui.exe
                                                                                                                                                        Imagebase:0x7ff63e580000
                                                                                                                                                        File size:266752 bytes
                                                                                                                                                        MD5 hash:3E8AFFA54035412F86663C8B44CAA2E5
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: MpCmdRun.exe PID: 460 Parent PID: 244

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:56
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
                                                                                                                                                        Imagebase:0x7ff708d60000
                                                                                                                                                        File size:455656 bytes
                                                                                                                                                        MD5 hash:A267555174BFA53844371226F482B86B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: conhost.exe PID: 5440 Parent PID: 460

                                                                                                                                                        General

                                                                                                                                                        Start time:15:18:57
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff6741d0000
                                                                                                                                                        File size:625664 bytes
                                                                                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: chrome.exe PID: 5816 Parent PID: 592

                                                                                                                                                        General

                                                                                                                                                        Start time:15:19:07
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\Program Files\Google\Chrome\Application\chrome.exe' https://remote.oracleindustry.com/session_complete?lsid=h%3D6e906df6caa57a0814aa268ff3d149259eb8bced%3Bl%3Dd5ad05e5dd134721bd791679f24ee989%3Bm%3Dsdcust%3Bt%3Dsd
                                                                                                                                                        Imagebase:0x7ff77b960000
                                                                                                                                                        File size:2150896 bytes
                                                                                                                                                        MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Analysis Process: chrome.exe PID: 4772 Parent PID: 5816

                                                                                                                                                        General

                                                                                                                                                        Start time:15:19:08
                                                                                                                                                        Start date:22/07/2021
                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,9401732187181444282,16578066958046228298,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8
                                                                                                                                                        Imagebase:0x7ff77b960000
                                                                                                                                                        File size:2150896 bytes
                                                                                                                                                        MD5 hash:C139654B5C1438A95B321BB01AD63EF6
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language

                                                                                                                                                        Disassembly

                                                                                                                                                        Code Analysis