Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample Name:	Setup.exe
Analysis ID:	694875
MD5:	a47b343c963dad673377364848549897
SHA1:	1faf9a21bf8dde2762ece37a1716f04664665b37
SHA256:	3d197e9b80ff2d1fb40dbbd2bacf0988a8e877986732dc39eadffaf6749df4dd
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for domain / URL

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Drops files with a non-matching file extension (content does not match file extension)

Queries the volume information (name, serial number etc) of a device

Drops PE files

Tries to load missing DLLs

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Queries keyboard layouts

Enables security privileges

PE file contains more sections than normal

Found dropped PE file which has not been started or loaded

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Enables debug privileges

Classification

Process Tree

System is w10x64native

Setup.exe (PID: 8032 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: A47B343C963DAD673377364848549897)

System.exe (PID: 372 cmdline: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe MD5: ACA468C6E2E01F3698C5E3C79394FB57)

System.exe (PID: 5216 cmdline: "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: ACA468C6E2E01F3698C5E3C79394FB57)

cmd.exe (PID: 5092 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

tasklist.exe (PID: 5116 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

System.exe (PID: 808 cmdline: "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: ACA468C6E2E01F3698C5E3C79394FB57)

System.exe (PID: 2796 cmdline: "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: ACA468C6E2E01F3698C5E3C79394FB57)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup.exe

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for domain / URL

Source: superfuniestindianparty.rip

Virustotal: Detection: 12%

Perma Link

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSE.electron.txt

Jump to behavior

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo	Jump to behavior

Source: Joe Sandbox View

IP Address: 104.18.42.171 104.18.42.171

Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Setup.exe

String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: dns.quad9.netConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: unknown

DNS traffic detected: queries for: superfuniestindianparty.rip

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process token adjusted: Security

Jump to behavior

Source: System.exe.1.dr

Static PE information: Number of sections : 12 > 10

Source: Setup.exe

Virustotal: Detection: 7%

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:552:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:552:120:WilError_03

Source: C:\Windows\System32\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

File created: C:\Users\user\AppData\Roaming\Game Installer

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsj4E21.tmp

Jump to behavior

Source: classification engine

Classification label: mal60.spyw.winEXE@14/93@3/3

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Setup.exe

Static file information: File size 62879521 > 1048576

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ffmpeg.dll.1.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.1.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.1.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.1.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.1.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.1.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.1.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.1.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.1.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.1.dr	Static PE information: section name: _RDATA
Source: System.exe.1.dr	Static PE information: section name: .00cfg
Source: System.exe.1.dr	Static PE information: section name: .retplne
Source: System.exe.1.dr	Static PE information: section name: .rodata
Source: System.exe.1.dr	Static PE information: section name: CPADinfo
Source: System.exe.1.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll.1.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.1.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.1.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.1.dr	Static PE information: section name: _RDATA
Source: a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node.9.dr	Static PE information: section name: .didat
Source: a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node.9.dr	Static PE information: section name: .00cfg
Source: a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node.9.dr	Static PE information: section name: _RDATA
Source: 7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node.9.dr	Static PE information: section name: .didat
Source: 7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node.9.dr	Static PE information: section name: .00cfg
Source: 7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node.9.dr	Static PE information: section name: _RDATA

Source: d3dcompiler_47.dll.1.dr

Static PE information: 0xF3329C94 [Sat Apr 18 07:26:12 2099 UTC]

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File created: C:\Users\user\AppData\Local\Temp\a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File created: C:\Users\user\AppData\Local\Temp\7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File created: C:\Users\user\AppData\Local\Temp\a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File created: C:\Users\user\AppData\Local\Temp\7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node	Jump to dropped file

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSE.electron.txt

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000409	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\elevate.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File Volume queried: C:\Users\user FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo	Jump to behavior

Source: C:\Windows\System32\tasklist.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\game installer" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\game installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="c:\users\user\appdata\roaming\game installer" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaiaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\game installer" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\game installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "c:\users\user\appdata\local\temp\28ys8twmdrj2bwul41wsjegnzvo\system.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="c:\users\user\appdata\roaming\game installer" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaiaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=plzserviceworker,sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Process created: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe "C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.bby	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies.bby	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bby	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bby	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	2 Process Discovery	Remote Services	1 Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	8%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\ffmpeg.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libEGL.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libGLESv2.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\elevate.exe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libEGL.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libGLESv2.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
dns.quad9.net	0%	Virustotal	Browse
superfuniestindianparty.rip	12%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com/dns-query	0%	Virustotal		Browse
https://dns.quad9.net/dns-query	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	104.18.42.171	true	false	0%, Virustotal, Browse	unknown
dns.quad9.net	149.112.112.112	true	false	0%, Virustotal, Browse	unknown
superfuniestindianparty.rip	unknown	unknown	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	0%, Virustotal, Browse	unknown
https://dns.quad9.net/dns-query	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.112.112.112	dns.quad9.net	United States		19281	QUAD9-AS-1US	false
104.18.42.171	chrome.cloudflare-dns.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.11.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	694875
Start date and time:	2022-09-01 05:57:04 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Setup.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.spyw.winEXE@14/93@3/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Changed system and user locale, location and keyboard layout to English - United States Enable AMSI

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, CompPkgSrv.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, spclient.wg.spotify.com, wdcpalt.microsoft.com, client.wns.windows.com, wdcp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link
104.18.42.171	https://paper.li/41i0IyhsDU2LHUTTqmDaP/story/ap-ausdredge-VBjAsEzkfIUV7miNpzaCi	Get hash	malicious	Browse
	http://first-dating.top/js/push/p.js?u=ra9pd06&o=911nfyq&t=66&v=2	Get hash	malicious	Browse
	Construction Drawingcouncil@cityofparramatta.nsw.gov.au--830962-df.htm	Get hash	malicious	Browse
	http://107.172.76.136/topp.exe	Get hash	malicious	Browse
	Secured_angela.johnson_Audio_Message.htm	Get hash	malicious	Browse
	ACH_WIRE_REMITTANCE.xlsx	Get hash	malicious	Browse
	INV#48390122.docx	Get hash	malicious	Browse
	#U043e#U0440#U043a#U043e#U0441#U0442#U0430#U043d#U0432#U0440#U0430#U0431#U043e#U0442#U0435.xlsx	Get hash	malicious	Browse
	Paid EFT Invoices.xlsx	Get hash	malicious	Browse
	http://timetogof.at/vento/6523.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
chrome.cloudflare-dns.com	https://paper.li/41i0IyhsDU2LHUTTqmDaP/story/ap-ausdredge-VBjAsEzkfIUV7miNpzaCi	Get hash	malicious	Browse	104.18.42.171
	http://first-dating.top/js/push/p.js?u=ra9pd06&o=911nfyq&t=66&v=2	Get hash	malicious	Browse	104.18.42.171
	Fax_Doc.htm	Get hash	malicious	Browse	172.64.145.85
	Ferdium-win-Portable-6.0.0-x64.exe	Get hash	malicious	Browse	172.64.145.85
	Construction Drawingcouncil@cityofparramatta.nsw.gov.au--830962-df.htm	Get hash	malicious	Browse	104.18.42.171
	http://107.172.76.136/topp.exe	Get hash	malicious	Browse	104.18.42.171
	Secured_angela.johnson_Audio_Message.htm	Get hash	malicious	Browse	104.18.42.171
	ACH_WIRE_REMITTANCE.xlsx	Get hash	malicious	Browse	104.18.42.171
	INV#48390122.docx	Get hash	malicious	Browse	104.18.42.171
	GalacticFever.exe	Get hash	malicious	Browse	172.64.145.85
	https://nhs-sharepoint.simplesite.com/	Get hash	malicious	Browse	172.64.145.85
	https://theproduct-4you.com/us/sgaq/goketogum-onl1?bhu=spkfL6hnkZo2Z5xGxgK1Hn2fuSAE7PhhBjqZs4	Get hash	malicious	Browse	172.64.145.85
	#U043e#U0440#U043a#U043e#U0441#U0442#U0430#U043d#U0432#U0440#U0430#U0431#U043e#U0442#U0435.xlsx	Get hash	malicious	Browse	104.18.42.171
	orkostansocialclubfrom09.06.xlsx	Get hash	malicious	Browse	172.64.145.85
	Paid EFT Invoices.xlsx	Get hash	malicious	Browse	104.18.42.171
	http://timetogof.at/vento/6523.exe	Get hash	malicious	Browse	104.18.42.171
	https://esca4.app.goo.gl/xdBo2PZ5GZufaehJ6	Get hash	malicious	Browse	172.64.145.85
	https://raptorcapr.site/Alarm-Com-Api-Documentation	Get hash	malicious	Browse	172.64.145.85
	Allegato documento d'ordine.html	Get hash	malicious	Browse	172.64.145.85
	badstuff.ps1	Get hash	malicious	Browse	172.64.145.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	rpt1661216698_20220823.exe	Get hash	malicious	Browse	162.159.133.233
	MEAioSUhW1.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	Inquiry#8899006720220831.exe	Get hash	malicious	Browse	104.19.185.120
	http://tdsshark.xyz	Get hash	malicious	Browse	172.66.40.91
	tGQ9T8Athj.exe	Get hash	malicious	Browse	188.114.96.3
	20220823_77466465553654,pdf.exe	Get hash	malicious	Browse	162.159.129.233
	PI_#U7f8e#U91d1#U532f#U738728.84 (USD 40,257+5% #U7a05#Uff09.exe	Get hash	malicious	Browse	104.19.184.120
	file.exe	Get hash	malicious	Browse	172.67.202.54
	Product Inquiry.exe	Get hash	malicious	Browse	172.67.154.88
	Rk3R1RBX9x.exe	Get hash	malicious	Browse	188.114.96.3
	rl86XSdHhM.exe	Get hash	malicious	Browse	188.114.97.3
	M6r4CJqwMd.exe	Get hash	malicious	Browse	188.114.96.3
	arinzezx.exe	Get hash	malicious	Browse	104.19.184.120
	THN6clTA6P.exe	Get hash	malicious	Browse	104.21.68.165
	https://rfp-skytech.myportfolio.com/	Get hash	malicious	Browse	104.18.11.207
	INV_PackingL_202208031_0104.exe	Get hash	malicious	Browse	104.19.185.120
	fraiche_0831003.js	Get hash	malicious	Browse	162.159.135.233
	file.exe	Get hash	malicious	Browse	188.114.97.3
	PURCHASE ORDER.exe	Get hash	malicious	Browse	188.114.97.3
QUAD9-AS-1US	contactupdate.exe	Get hash	malicious	Browse	9.9.9.9
	http://www.sotuu.net/php/download.php?q=5ufoeUA&e=https://saojoaocentrohistorico.com.br/2mintunesmand/wealldidherekjhrfd/q7qPE/rforsha@s3gov.com	Get hash	malicious	Browse	9.9.9.9
	https://lacodoo-my.sharepoint.com/:o:/g/personal/davorin_kelenc_la-co_si/Egb2ztyp9yVDpnjQEuVL6LIBm9H_n-PxxnuE4pAnfN0cMg?e=6IGn6C	Get hash	malicious	Browse	9.9.9.9
	https://www.turnerdrake.com/blog/ct.ashx?id=1872b9a5-838a-40ec-a587-47c22c252c62&url=https://wq014i.codesandbox.io?dg=ZWxzLnJvZ2dlQGluZnJhYmVsLmJl	Get hash	malicious	Browse	9.9.9.9
	Payment Advice Note.xls	Get hash	malicious	Browse	9.9.9.9
	Invoice Copy.xlsx	Get hash	malicious	Browse	9.9.9.9
	0000281895.html	Get hash	malicious	Browse	9.9.9.9
	ImTip.7z	Get hash	malicious	Browse	9.9.9.9
	https://1drv.ms/o/s!BNifvYLRjxaZgT6yO_s7Od1eKKVO?e=Re-mxSsKOECUCPb51hI9ow&at=9	Get hash	malicious	Browse	9.9.9.9
	https://msg813.simplesite.com	Get hash	malicious	Browse	9.9.9.9
	https://wesharesfile.teamec.club/	Get hash	malicious	Browse	9.9.9.9
	https://wesharesfile.teamec.club/	Get hash	malicious	Browse	9.9.9.9
	PO 112846.pdf	Get hash	malicious	Browse	9.9.9.9
	iMapU.xlsm	Get hash	malicious	Browse	9.9.9.9
	GalacticFever.exe	Get hash	malicious	Browse	9.9.9.9
	https://tielearnnot.top:443	Get hash	malicious	Browse	9.9.9.9
	L1ld - Linkvertise Downloader_PE2-ku1.exe	Get hash	malicious	Browse	9.9.9.9
	https://aeindo.co.id/cvt/	Get hash	malicious	Browse	9.9.9.9
	http://dzh.ylfjso.top	Get hash	malicious	Browse	9.9.9.9
	Proforma invoice 702401.url	Get hash	malicious	Browse	9.9.9.9

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll	GalacticFever.exe	Get hash	malicious	Browse
	Bloom.7z	Get hash	malicious	Browse
	AsanaSetup.exe	Get hash	malicious	Browse
	6DNTEUx66h.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.MulDropNET.43.26999.exe	Get hash	malicious	Browse
	InstallSlack.exe	Get hash	malicious	Browse
	YouTube To Mp4 Converter.exe	Get hash	malicious	Browse
	YouTube To Mp4 Converter.exe	Get hash	malicious	Browse
	Dante.7z.exe	Get hash	malicious	Browse
	winpro.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.idx

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.020373530227265995
Encrypted:	false
SSDEEP:	3:PVYlGlll/l/lXp9ZjXslAyUg0PBYGGJDASPllfllL/mRl/+tDX5/Pll:P+0NspUg0PBYGA7/eEh
MD5:	51CFBD885984576E8ADBAB19850C1413
SHA1:	B681998E798A6308D7F8C1F7DCD77146BE7FC53F
SHA-256:	5B5444534C2165ED28EE37A8FF2DA61867FD6263AFF79EECD18C615F5C830EA2
SHA-512:	0E735B90812050858404F0A32840E66640B89862C3F0DE3DDD2435C283BFFF27AC5E5E7D73704E84DBEC36AA98789A157CB0524F90516497717439E2A35338F7
Malicious:	false
Preview:	y.q.........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.lock

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.val

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.07552303098276847
Encrypted:	false
SSDEEP:	12:7VQ1oi1IfKS24iPtkJ7Rvi/lBZXt83PD5jhs:GvlSY4R0BZXs
MD5:	6F31973C0464C4EE53BA0B992BDE0760
SHA1:	8EB158984E64A031072A1FFA9CC61EF90B5E9E5C
SHA-256:	46960C5F69B979FBB1CF9ADF14BDA0138D777DB02CD74C66C4A9B057F85B609C
SHA-512:	4D324C4FC64DE58A2C2223666448826E8CE03DF847CAFB99CE099AD2DD2008D7037AEE97E088E33B354D971D97FD60C2288713942C99C3D33152EBBC37A417EC
Malicious:	false
Preview:	....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.8.Y.S.8.t.w.M.d.r.J.2.B.W.U.L.4.1.W.S.j.E.g.n.Z.V.o.\.S.y.s.t.e.m...e.x.e...........................(...p.DJ!.IL.....Z.:B-.%...................>..I....>..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.012679599570088879
Encrypted:	false
SSDEEP:	3:H4lllGlll/l/lXp9ZjrPBY0cl/rtVltDP:Hel0dPBY0c/Vlh
MD5:	F5202E049652E2CD597266511A471F54
SHA1:	9FCA5602A88EE70667D81169694BA28865D16CB1
SHA-256:	3B4A3CFA41C63966915DB278B69CE80FF23C5A13B553A378DC47F4D87425D0C8
SHA-512:	2880DB66CF2786BF6957713E9DDD55D766C4F982FBC746B63AC5C537072F509CBBAD8BE500A1F84F15D4A041B175833E5F2E3EE795D0D3BE8683137820D6AC86
Malicious:	false
Preview:	..._........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.030744009255147437
Encrypted:	false
SSDEEP:	3:9llzzd2DJqojreL1QNuVdhOEjlpQlyEXlxlXVl5tJZ91nLEPlglmLl+lyldRDA6O:m9q0TQXUEZ+lX1HTEi1lyfRc6tD2Hrn
MD5:	C08C867F3283D90AD1C0DB8BB084FB34
SHA1:	77CCC4A1E62234F8FA10130FCE5E496DFE3E0203
SHA-256:	554E1EE15D8B62C631CDC0CF1853CA30C27FA7E29B414960753B25322331EEF5
SHA-512:	B525F928191E0D84B7513AF36759579D446727E44394DBEECA4050FAD776C28BD74117CC438B64F13E7187D57B09D2F040F79089B84E9AB2336DC1B161CCBEC3
Malicious:	false
Preview:	....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.8.Y.S.8.t.w.M.d.r.J.2.B.W.U.L.4.1.W.S.j.E.g.n.Z.V.o.\.S.y.s.t.e.m...e.x.e...........................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	2.9216957692876595
Encrypted:	false
SSDEEP:	384:ST8XNcKu0iTwbAziYN570RMZXVuKnQM2V6ofbDO4xmTgZcZygSA2O9RVHfwrhhxV:JNcgiD5Q6luKQM2V7DXcAgSA2KD4jL
MD5:	1A706D20E96086886B5D00D9698E09DF
SHA1:	DACF81D90647457585345BEDD6DE222E83FDE01F
SHA-256:	759F62B61AA65D6D5FAC95086B26D1D053CE1FB24A8A0537ACB42DDF45D2F19F
SHA-512:	CFF7D42AA3B089759C5ACE934A098009D1A58111FE7D99AC7669B7F0A1C973907FD16A4DC1F37B5BE5252EC51B8D876511F4F6317583FA9CC48897B1B913C7F3
Malicious:	true
Preview:	SQLite format 3......@ ...$...................................................................$..S`.........g.....[.[.[................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.7853305971874845
Encrypted:	false
SSDEEP:	48:43b/DVIIgyZKLk8s8LKvUf9K4UKTgyJqhtcebVEq8Ma0D0HOlcjlGxdKmtAONu41:Sb+uKLyeym/grcebn8MouOjlGxdKmt3N
MD5:	00C036C61F625BF9D25362B9BE24ADEB
SHA1:	6738C3D037E4A2E9F41B1398BA88E5771532F593
SHA-256:	0C187B091E99E5BB665C59F8F8E027D5658904B32E4196D2EB402F3B1CAD69EF
SHA-512:	711265BC8C1653BF6E862343BF3149A2AB09F4BA7D38E2D8A437001DB6C0F1936F6362571DD577CD7BDBEEC766DF141CB7E0681512C12E25A99CDB71731232D1
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	1.3142342988381548
Encrypted:	false
SSDEEP:	192:4BUfJShWdeeH9JbMBlTJjnhosntrV6BVuH3o:6UfJSeeY9qnhosntJ8VuH3o
MD5:	980652DF2E2B8D2F2B431D01E33E3121
SHA1:	F5133AB72E02FBA1A0C5D5F2511216D812AE3BD5
SHA-256:	E2B70022A3DA7D6A031256BC6D09B9A6364E5974F6AE1ED1A920333DCA592106
SHA-512:	BA20D40E6D3F707021E4A4A5EC9DDC193815843C5A044AE94E2CDBE4A52FD50FB6E7D1E9E79E8A7030C0BCDBDE1033F2F45178AF9FF2A8DF54B53672A4F0100F
Malicious:	true
Preview:	SQLite format 3......@ .......-........... ......................................................S`...........(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cookies.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.3172897780113213
Encrypted:	false
SSDEEP:	96:oNwCz2C+NR73QOaq9kozeav2RT3VnnnekEEN9ORelnasL:ouZC+NJLaqe0LUTpnn1DN9OROnj
MD5:	D5ECE7413F423743B368D55921D78C0A
SHA1:	3F1E854E373FB2F9BFD868AF38AF5C6B3CD2A71D
SHA-256:	D38D8A693CD4B718EA9E4995939262749893878EE9A0931BEB0F33781979FD77
SHA-512:	F54CAB99D2795DF2D01E54D1E1184D116A56E8053140BAF868ADBFC7EE35EFBC59F83E3FF26C84E0D6D1A118BB79CAB82527F1502D328483953A0A58BEED8E0B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g.....8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8182303930711242
Encrypted:	false
SSDEEP:	96:+RMKLyeymwxCn8MZyFltK3PlGNxot83n:+RkxGO8PlGNxz
MD5:	A93B35941137916187814E3E7C88C93D
SHA1:	3834E7B2A614BD688831CFC47786729F6CAC0121
SHA-256:	0D1DC0E9F4C9BE281E17D24AC969E0FF3F8388114420417126A4F502EABC3107
SHA-512:	84A749B77BBED02944C9B25D1B98C638B3DBB906A2A222FF9FB229C7AC0C8A64D123D1CB47A1E9A88FB9E67BAD0928FE1C952152F30311EFC6C8B9330B9441B4
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.bby

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1305327154874678
Encrypted:	false
SSDEEP:	192:oLt4nKTjebGAUJp/XH9euJDvphC+KRmquPWSTVumQ6:it4nsJp/39RDhw+KRmqu+cVumQ
MD5:	D331C900DDE8ACB523C51D9448205C0A
SHA1:	BDB3366F54876E78F76A6244EDA7A4C302FEB91D
SHA-256:	F199798DF1C37E3A8F6FFF1E208F083CF687F5C6A220DCAD42BB68F2120181CD
SHA-512:	415E4F4F26D4F861063676EA786C2941DB8DB7E248E32D84595BC7D531CE19669AFDCB447BC18B0B723839984CD15269FF6E89EBCD168D8EBD0EC7AF86CC92E7
Malicious:	false
Preview:	SQLite format 3......@ .......;...........O......................................................O}...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSE.electron.txt

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSES.chromium.html

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5490737
Entropy (8bit):	4.827437352926398
Encrypted:	false
SSDEEP:	12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS
MD5:	DF37C89638C65DB9A4518B88E79350BE
SHA1:	6B9BA9FBA54FB3AA1B938DE218F549078924AC50
SHA-256:	DBD18FE7C6E72EEB81680FABEF9B6C0262D1D2D1AA679B3B221D9D9CED509463
SHA-512:	93DD6DF08FC0BFAF3E6A690943C090AEFE66C5E9995392BEBD510C5B6260533B1522DC529B8328DFE862192E1357E9E98D1CDD95117C08C76BE3AB565C6EEA67
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<style>.html {. --google-blue-50: rgb(232, 240, 254);. --google-blue-300: rgb(138, 180, 248);. --google-blue-600: rgb(26, 115, 232);. --google-blue-900: rgb(23, 78, 166);. --google-grey-200: rgb(232, 234, 237);. --google-grey-800: rgb(60, 64, 67);. --google-grey-900: rgb(32, 33, 36);.. --interactive-color: var(--google-blue-600);. --primary-color: var(--google-grey-900);.. --product-background: var(--google-blue-50);. --product-text-color: var(--google-blue-900);.. background: white;.}..@media (prefers-color-scheme: dark) {. html {. --interactive-color: var(--google-blue-300);. --primary-color: var(--google-grey-200);.. --product-background: var(--google-grey-800);. --pro

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146324992
Entropy (8bit):	6.716389161946616
Encrypted:	false
SSDEEP:	786432:GJMEeN/D9UTHJLYkCeCQtad3jb6DRnuUZOiy6S4nPdTANdTGF:GyP9SHJHJtUd3v6DRnuMO0cz
MD5:	ACA468C6E2E01F3698C5E3C79394FB57
SHA1:	ACC1422FC779511B9C028C8FDAE9DD8C3291F54F
SHA-256:	0740A4C51D424388FC7C6DCDC1E229139E768CEA315D442EC82AD1AD7F406756
SHA-512:	EA702A8A267472FEC0341B076C6AF90C8DDFC1F2EAC55B62B27C938CEDF6E00BDE272FF7E3F4079D02493684B7A63B07CD71B7D0FB7F90172979D083756F8C10
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........."......n...8...............@..........................................`..........................................D`..A..f.c.h................b9..........0...t...+W......................%W.(.......0.............c.H....._.`....................text...xm.......n.................. ..`.rdata...K.......K..r..............@..@.data...<tB..0g...... g.............@....pdata...b9......d9..&o.............@..@.00cfg..(.... ......................@..@.retplne`....0...........................rodata......@...................... ..`.tls....i....`......................@...CPADinfo8....p......................@..._RDATA..............................@..@.rsrc...............................@..@.reloc...t...0...v...H..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\chrome_100_percent.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	142210
Entropy (8bit):	7.920292114789674
Encrypted:	false
SSDEEP:	3072:+Kzw9bp66mdgZeMj6g2Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:+Kzw986mdgZezgm8Gb0OV8ld0GecQ3m3
MD5:	9C1B859B611600201CCF898F1EFF2476
SHA1:	87D5D9A5FCC2496B48BB084FDF04331823DD1699
SHA-256:	53102833760A725241841312DE452C45E43EDD60A122546105AB4020CCEF591B
SHA-512:	1A8EC288E53B9D7E43D018995ABE4E3D9C83D329D0561FBB7D022E8B79FFECF033E995B9BC6AF352A71C646A1E8AFBA4ADDB54DEAB7455F24B7A279A3DD7C336
Malicious:	false
Preview:	..................#.N...:.....:f....;f....<f....=f....>f1...?f....@f....Af....Bf....Cf....Df/...Kf."..LfM$..Of.%..Pf:'..Wf.'..Xf31..Yfa9..Zf.;..[f)<...s.=...s8>...s.?...s.B...s.E...s.I...s.M...s.P...s.T..,tWX..-t.Y...t.[../tp\..0tc]..1t.^..6t.^..7t....8tV.....+...........d.....a........................................I.................E.................=.....]............"..!.9,..".q6..(..:..).?<....E..+..M..,.pN..-..O.....Q../..T..1..U..3..X..4..Z..5.c\..6.:^..7..`..8.>a..9..b..:.Pd..<..g..=..i..?.Gl..@..m..B.:q..C..t..H.:v..J.....K.....L.....M.....N.x...O.Z...P....Q.T...R....S.....T.....U.W...V.<...W.....X.....Y.....Z.....[.N...\.<...].....^...._.....`.....a.e...b.:...c.....d....h.....i.{...j.B...k.....l.....m.....n.@...p.R...q.....r.....s.r...t.....u.X...v.....w.....x.J...y.....z.....{.....\|.F...}.....~.............F.....}.....s.....h.....`...<.:...=.....>.....?.3...@.....A.....B.....C.....D.f...E.....F.....G.I...H.]...I.G...J.....K.G...L.....M.T...N.....O.m ..P.. ..R..!..S..!

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\chrome_200_percent.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	207666
Entropy (8bit):	7.9466777607848815
Encrypted:	false
SSDEEP:	6144:MDQYaF+9b16mdgZezVk5GMRejnbdZnVE6Yopym74:hfs1FdgEj6edhVELo374
MD5:	B51A78961B1DBB156343E6E024093D41
SHA1:	51298BFE945A9645311169FC5BB64A2A1F20BC38
SHA-256:	4A438F0E209AC62FFA2C14036EFDD5474B5ECAA7CBF54110F2E6153ABDFB8BE9
SHA-512:	23DEDDE25AD9CB5829D4B6092A815712788698C2A5A0AEFB4299675D39F8B5E2844EABD1EA42332A0408BD234548F5AF628E7E365AB26F3385EBFA158CDD921D
Malicious:	false
Preview:	..................#.O...:.....:fz...;f....<fm...=f2...>fp...?fk...@f)&..Afe+..Bfu...Cf.5..Df":..KfyB..Lf.D..Of_F..Pf.I..WfYJ..Xf.^..Yf.p..Zf'v..[f.v...s#x...s.\|...s8....s,....s1....sp....s.....sc....s....,t...-t.....t..../t....0t....1t....6t<...7t....8t............].......................(...........M!.....)....u0.....5....X;....:B.....D.....H.....L.... V....LY.....a.....e..!.Lo.."..y..(..}..).v....M...+....,.....-........./....1.....3.....4....5.Z...6.1...7....8....9....:.....<.....=.....?.....@....B.C...C.....H.5...J.f...K.\...L.<...M.....N.M...O.g...P.k...Q.....R.J ..S..!..T.P#..U..$..V.T&..W..(..X....Y.T/..Z.B4..[.#<..\..D..].bE..^..F.._..H..`.zI..a..J..b.7L..c..O..d..S..e..W..f..X..g.TZ..h..[..i.....j."...k.q...l.....m.w...n.0...p.B...q.....r.....s.A...t.....u.....v.....w.....x.....y.....z.....{.....\|.....}.....~.'.....H.....<.................n.....2...<.,...=.....>.....?.I...@.....A....B.....C.Y...D.....E.....F.k...G.....H.....I.....J.`...K.....L.{...M.....N.....O.C.

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4524696
Entropy (8bit):	6.367051782021837
Encrypted:	false
SSDEEP:	49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
MD5:	7641E39B7DA4077084D2AFE7C31032E0
SHA1:	2256644F69435FF2FEE76DEB04D918083960D1EB
SHA-256:	44422E6936DC72B7AC5ED16BB8BCAE164B7554513E52EFB66A3E942CEC328A47
SHA-512:	8010E1CB17FA18BBF72D8344E1D63DED7CEF7BE6E7C13434FA6D8E22CE1D58A4D426959BDCB031502D4B145E29CB111AF929FCBC66001111FBC6D7A19E8800A5
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: GalacticFever.exe, Detection: malicious, Browse Filename: Bloom.7z, Detection: malicious, Browse Filename: AsanaSetup.exe, Detection: malicious, Browse Filename: 6DNTEUx66h.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.MulDropNET.43.26999.exe, Detection: malicious, Browse Filename: InstallSlack.exe, Detection: malicious, Browse Filename: YouTube To Mp4 Converter.exe, Detection: malicious, Browse Filename: YouTube To Mp4 Converter.exe, Detection: malicious, Browse Filename: Dante.7z.exe, Detection: malicious, Browse Filename: winpro.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S........................................a.............................................................................Rich....................PE..d.....2..........." ......3.........0.&.......................................E.....VTE...`A..........................................A.x.....A...... E.@.....B..!....D.."...0E....P.>.T....................{7.(...pz7..............{7..............................text...D.3.......3................. ..`.rdata........3.......3.............@..@.data....#....A.......A.............@....pdata...!....B.."...>B.............@..@.rsrc...@.... E......`D.............@..@.reloc......0E......fD.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\ffmpeg.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2725376
Entropy (8bit):	6.676740046816981
Encrypted:	false
SSDEEP:	49152:ScMr6+FXptsXTmgP7he370olRK+KCKyRb+kyqVZWxX0b4unfruHZ:kKer0olGyByEf8
MD5:	B1578D4CED692C825E51F111AB291E67
SHA1:	BFE1A123D91EAEDE0EA2F261FC3BDB431517B5CC
SHA-256:	4CD1B26FE1F0A788FEAC4B6130CD5DBC7DB3A7290DB8B8B0A0286F2ED0026B77
SHA-512:	62F9AA2DF3F7580AD4643AE1318CFA9B603C0BA4030B24D4505F0A61C8C9ECACA7AA919AEBCF30B16F30ECC71DDEDCB1A01B6BF74E53A64C75F2C7318207037B
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." .....V!..<.......T........................................?...........`A..........................................'.......(.(.............>..............?../....'.......................'.(...p.!.0.............(.0............................text....T!......V!................. ..`.rdata..,6...p!..8...Z!.............@..@.data.........(.."....(.............@....pdata.......>.......(.............@..@.00cfg..(....P?......`).............@..@.tls.........`?......b).............@..._RDATA.......p?......d).............@..@.reloc.../....?..0...f).............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\icudtl.dat

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10269664
Entropy (8bit):	6.286891201727671
Encrypted:	false
SSDEEP:	196608:w9zwSv9AAQlCy4liXUxCGZHa93Whlw6Zi88EAb:wWKlQlz4liXUxCGZHa93Whlw6Zf8EAb
MD5:	599C39D9ADB88686C4585B15FB745C0E
SHA1:	2215EB6299AA18E87DB21F686B08695A5199F4E2
SHA-256:	C5F82843420FA9D144E006B48D59BA7EF95F7E6CB1EA95B27FCDD2C97F850859
SHA-512:	16194186A8407B29F799D4B02F5674E4FBD5D91163FAD9F8DCE6CEEDD865B754A681AA960D0F3F1B62CB21D5443879F1B8E9B691C19C5802D5BDFE4ED645B8BC
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ./...\|A..@....A.......A..0....A.......A.......A.. ....A...%...A..@&...B...&...B..Pn..,B...n..?B...o..RB...o..eB..Pp..xB...r...B..`r...B...r...B.. s...B...s...B..0u...B..pv...B.. w...C...w..#C...x..6C...y..IC...{..\C..@}..oC...}...C...~...C..@....C.. ....C.......C.......C..P....C.......D.......D......-D......>D..P...RD......bD......uD..`....D.......D.......D..0....D.......D......D.. ....E..p....E......'E.. ...:E..p...QE......aE..@...tE.......E.......E..0....E.......E..p....E...1...F....&..F..0.&..F....&.EF....&._F....&.vF....&..F..@.&..F....&..F.. .&..F..@Y(..F...$)..G..P.)./G..`.).QG...J.qG......G....+..G....+..G....+..G..0.+..G....+..H..pe+..H..p.+.LH..0.-.eH....-.\|H....-..H....-..H..0.-..H....-..H.. ....H..p....H.......I......%I...I..8I...I..KI..0J..^I...J..qI...J...I..0K...I...K...I...M...I...o...I...q...I..0....J.......J..`...,J..p$/.AJ..

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	447488
Entropy (8bit):	6.307369526332632
Encrypted:	false
SSDEEP:	6144:PdpiWYLBViWOSdAr1Knk2mI3LpxE0RYqowpW6VmHrtYf1FI:1pvYLbiWBqrQnPxE0cKmHZcP
MD5:	03E6F7775EB53CEB417B89E3C843F557
SHA1:	8DBC7FD1BA83FF85D254CBADE52715FD93A3064A
SHA-256:	B9FBA20B5345EA3B297D03F112A5138598DA2AB1EED1729D1C7CEC61D0FF4320
SHA-512:	DE33315E11A61A747AADE4B87E2C8B19A2B5AA69628CB8B43109235C0BB1F18DF1277AC53D864D0576C5191A6782446D9FCE1BA6E87E35A4E3673BA35A65E95B
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." ........................................................P............`A....................................................(....0..x........=...........@......\|...........................(.......0...........0................................text...f........................... ..`.rdata..............................@..@.data...\|L...p... ...\..............@....pdata...=.......>...\|..............@..@.00cfg..(...........................@..@.tls....!...........................@..._RDATA....... ......................@..@.rsrc...x....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6985216
Entropy (8bit):	6.408181533090436
Encrypted:	false
SSDEEP:	49152:Q2u/fQEi3nJnOxl8mdufi1FN76y1azqXMt3Id2NoTjuUSdv4CNLtvGExll8pupWD:lUl8OL7qtsq3sjfgpfGBEM8mP
MD5:	5BDA3438BA41B4169ACA353208738597
SHA1:	C745813F7D4CCA83039A2B702CCDBB325879ADC3
SHA-256:	16FE74DB3068898CE71BC9A798C8C6CF71899630632AB06EEDCBFAEA476EF71B
SHA-512:	9FCE5C9E8724A87699E5FCFB1349CF11D44A1C129C819BDC1EC15F0BDB9F51597512F6C0BC131E94A188028D82774F39488EBCD95CC51787DD64BD8EFDB9C12E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." ......P...........F......................................pk...........`A..........................................a.......b.d....pj......0h.@.............j.....\|.a......................a.(...0.P.0.............b..... .a.@....................text.....P.......P................. ..`.rdata........P.......P.............@..@.data...X.....c.......c.............@....pdata..@....0h.......g.............@..@.00cfg..(....@j.......i.............@..@.tls....1....Pj.......i.............@..._RDATA.......`j.......i.............@..@.rsrc........pj.......i.............@..@.reloc........j.......i.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	179817
Entropy (8bit):	4.920631881301119
Encrypted:	false
SSDEEP:	3072:u5ghhWHOj0/E92t7Rh4rgEkDvuh78oeLtykiqfVGMqyZJjhEf2WAqT5b0kek97G4:u5cW/gUuAQPPgx30jH8+D
MD5:	E18A450EF034B42599341C3D09F280F1
SHA1:	2001C8A85904962AC3A96938ECCC69AD2C110FDF
SHA-256:	7C2B9098130F1F9E0CF4507B64C0E96AC6354BD6C3616BE20E2067CFCCC820DA
SHA-512:	DDD87571218FE9F179A6C2A8A15B182625A71A7C19ED90C0969CA2E0E9BAD823B926F8B8A6B390CB6FE9C95F4B6C1F1EC7B5167A8424AB1921943922208F798A
Malicious:	false
Preview:	........?.(.j.,<..k.;<..l.F<..n.N<..o.S<..p.`<..q.f<..r.u<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....=.....=.....=.....=.....=.....=....F=....b=....x=.....=.....=.....=.....=.....=.....=.....>....6>....h>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....?.....?....!?....C?...V?..+.Y?..,.w?../..?..0..?..1..?..2..@..3.@..4.Z@..5..@..6..@..7.$A..>.YA..?.cA..N..A..g..A..i..A..j..A..k..A..l..A...Z.A...Z.A...Z!B...Z.C...Z.C...ZLC...ZrC...Z.C...Z.C...Z.C...Z.E...Z.E...Z.E...Z.E...Z.F...Z,F...Z_F...Z.F...Z{G...Z.G...Z.G.. Z.H..!Z,H.."ZhH..#ZqH..$Z.H..%Z.H..&Z.H..,Z8I..5ZWI..7Z.I..=Z.I..>Z.I..?Z.I..AZ?J..BZnJ..CZ.J..DZ.J..EZ.J..FZ.J..GZ;K..HZ.K..JZ.L..KZ.L..LZ.M..MZ.M..PZHM..QZ(N..RZ8O..SZOO..TZxO..VZ.O..WZ.P..XZ.Q..YZ.Q..ZZ.Q..[Z.Q..\Z.T..]Z8U..^Z.V.._Z.V..aZ.V..cZ.V..dZ.V..eZ.W..fZ.W..gZcW..lZ.W..mZ/X..nZ.X..oZ.Y..pZ.Y..qZ{Y..rZ.Y..sZPZ..tZ.Z..uZ.[..zZ.[..\|Z.[..}Z.[..~Z.[...Z.\...Z?\...Zu\...Zv\...Z.\...Z.\...Z.\...Z.\...Z.]...Z.]...Z.]...Z.]

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	185530
Entropy (8bit):	5.006157940362164
Encrypted:	false
SSDEEP:	3072:EWJH2KNRpqhXdJXFx3zGF+hF/MMCS2xHMuZtE9P6NWM00f8K1U/e17MgSENBKSIa:EWbNRiz+bNMgSEN08I1ZU5
MD5:	2F9D6532E4416A1688A62FA305804279
SHA1:	D2EB399D9FC89886944307C4F55418AA49F70611
SHA-256:	9EE9AD03BF7521CBC72CEB7F3DF8D5E08CC31D3E1B2D02B31FBD25AB67561B9B
SHA-512:	678721700EFE6D2475FC0235FADD60F9C101186574E7F25874AD17D2F0A1F0F559DDF4DED8F1EA29EA047333CB5A44ED402E4458B868B64128FB1AC76DFBBF3F
Malicious:	false
Preview:	........6.1.j..<..k.)<..l.4<..n.<<..o.A<..p.N<..q.T<..r.c<..s.t<..t.}<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....=.....=....H=....a=....~=.....=.....=.....=.....=.....=.....>....8>....W>....r>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....?.....?...??..+.B?..,.`?../.w?..0..?..1..?..2..?..3..?..4..@..5.>@..6..@..7..@..>..@..?..A..N..A..g.+A..i..A..j.2A..k.7A..l.AA...ZFA...Z.A...Z.A...Z.B...Z.B...Z.C...Z8C...ZZC...Z.C...Z.C...Z.G...Z.G...Z.G...Z.G...Z.H...Z$H...ZOH...Z.H...ZxI...Z.I...Z.I.. Z.I..!Z.J.."ZJJ..#ZVJ..$ZxJ..%Z.J..&Z.J..,Z.J..5Z.K..7Z6K..=Z<K..>ZaK..?ZvK..AZ.K..BZ.L..CZ5L..EZPL..FZrL..GZ.L..HZEM..IZ.M..JZ.N..KZ.N..LZ.N..MZ.O..PZ<O..QZ.O..RZ.P..SZ.Q..TZ&Q..VZeQ..WZ.R..XZ.S..YZ.S..ZZ.S..[Z.T..\Z3X..]Z.Z..^Z.[.._Z.\..aZG\..cZQ\..dZh\..eZy\..fZ.\..gZ.\..lZ.]..mZ.]..nZb^..oZ.^..pZ.^..qZ._..rZ._..sZ`..tZ.`..uZ.a..zZ.b..{Z.b..\|Z'b..}Z-b..~Z3b...Z_b...Z.b...Z.b...Z.b...Z.b...Z.b...Z.c...Z.c...Z.c...Z(d...ZGd...Z.d...Z.d

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	200902
Entropy (8bit):	4.727038889612471
Encrypted:	false
SSDEEP:	6144:jd7NaT75nv/L06ZzrmLy8AqWJ2JAnsUVT:jfaT75nvT0XLy8AqWJ2JAV
MD5:	5BA0C7200362C9ED55610CC8B66EF53C
SHA1:	D45239C2F1B00885407771A41A7776FC1FE8FA3B
SHA-256:	2339FF55464B4FF704FC3C5BF281EEC52A539C494BD059CF0346D9C05AB7CDA7
SHA-512:	6229DBF08A9322C4EC8DE4912AA1832F01800A71B7E3EF5870E7FA2B623BE4DD248FEC4881C3E031E984616147BE84D42AB3DD970AE56DC1BD78913A8682A37A
Malicious:	false
Preview:	........`...j.n<..k.}<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}. =....(=....-=....5=....==....E=....L=....S=....Z=....[=....\=.....=.....=.....=.....>....%>....'>....+>....7>....J>....e>.....>.....>.....>....#?....?....-?.....?....B?....X?....t?.....?.....?.....?.....?.....?.....?....@..+..@..,.6@../..@..0..@..1..@..2..A..3.:A..4.xA..5..A..6.$B..7.HB..>.{B..?..B..N..B..g..B..i..B..j..B..k..B..l..B...Z.B...Z(C...ZeC...Z.D...Z.D...Z.D...Z.E...Z+E...Z.E...Z.E...Z1G...ZaG...ZoG...Z{G...Z.G...Z.G...Z.G...ZZH...Z.I...Z.I...Z.J.. ZVJ..!Z~J..#Z.J..$Z.J..%Z.K..&Z0K..,Z.K..5Z.K..7Z.K..=Z.K..>Z.L..?Z7L..AZ.L..BZ.L..CZ!M..DZIM..EZUM..FZ.M..GZ.M..HZ.N..IZtO..JZ6P..KZfP..LZ.P..MZ.P..PZ.P..QZ.Q..RZ.S..SZ.S..TZUS..VZ.S..WZ.T..XZOU..YZ\U..ZZsU..[Z.U..\ZnW..]Z.X..^Z.X.._ZUY..aZ.Y..cZ.Y..dZ.Y..eZ.Y..fZ.Y..gZLZ..lZ.Z..mZA[..nZ.[..oZ6\..pZY\..qZ.\..rZq]..sZ.^..tZ.^..uZ.^..zZ.`..\|Z-`..}Z7`..~ZC`...Zp`...Z.`...Z.`...Z.`...Z.a...Z.a...ZCa...Z.a...Z.a...Zgb...Z.b...Z.b

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	259689
Entropy (8bit):	4.354960890250521
Encrypted:	false
SSDEEP:	1536:xX/nV+Lr+p2KJJr98JMgNxpDwuDrXvuhKRcX:xX9++9Jr
MD5:	47C95E191E760DEE3EF43345577E2379
SHA1:	609634315270A91D4EC631642B18BD0036367AAD
SHA-256:	CEED32E429ED1018D4C49343CF52105CBFD1E877C531A5738FD6E6CD33D27DA7
SHA-512:	46B5F8D58780D19E79136C31A67D075C57DDF7E6A1EB197DEA4088CC414A0DC24A68FC8EBCAAC03B3940AF2461123B586706D5DBF8DBDF6FBEA0F7BEC466DB21
Malicious:	false
Preview:	........B.%.j.2<..k.A<..l.L<..n.T<..o.Z<..p.g<..q.m<..r.\|<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....=.....=.....=.....=.....=....$=....%=....&=.....=.....=.....>....0>....m>....o>....s>.....>.....>.....>.....?....7?....[?.....?.....?.....?.....?.....?.....?.....?.....?.....@....@....B@....p@....@..,..@../..@..0..@..1.VA..2.vA..3..A..4..A..5.@B..6..B..7..B..>.WC..?.jC..N..C..g..C..i..C..j..C..k..C..l..C...Z.C...Z.D...ZaD...Z.F...Z#F...Z.F...Z.F...Z.F...ZzG...Z.G...ZaJ...Z.J...Z.J...Z.J...Z.J...Z.K...ZjK...Z.K...Z.L...ZFM...ZXM.. Z.M..!Z.M.."Z.M..#Z.N..$ZXN..%Z.N..&Z.N..,Z$O..5Z4O..7Z_O..=ZuO..>Z.O..?Z.O..AZqP..BZ.P..CZ.P..DZ)Q..EZ?Q..FZ.Q..GZ.Q..HZ=S..IZDT..JZNU..KZyU..LZ.U..MZ.V..PZQV..QZ.W..RZ.Y..SZ.Y..TZ.Z..VZ~Z..WZ.[..XZ.\..YZ.]..ZZ9]..[Z.]..\Z.a..]Z.b..^Z.c.._Z.d..aZ.d..cZ.e..dZ+e..eZ4e..fZce..gZ.e..lZ.f..mZ6g..nZ@h..oZ]h..pZ.h..qZ.h..rZ.i..sZWj..tZ.k..uZuk..zZ.l..{Z.m..\|Z%m..}Z.m..~Z7m...Zym...Z.m...Z.n...Z.n...Z@n...ZCn...Z.n...Z.o...Z[o...Z.o...Z+p

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	125071
Entropy (8bit):	5.4026594922836955
Encrypted:	false
SSDEEP:	3072:HmXgDaRcg4H65rqx0hm/BL8lmoT69Q1HSNO5ufEfXiBCUpYEHPPXfI5DozRhqAnt:GACcgwoFyO5vXiBCUpY+PXf8DyBnkAkE
MD5:	4779F3897E3583DE0E9A27FFEB61C7BA
SHA1:	784407C6BE9CCACB15238E5A4B9E9593EBF2244F
SHA-256:	EE7D0B6EF288D932D606DC7B0D99D5D1F467A7595C043143F6892B208D7331A1
SHA-512:	230E840373C1533D1D28CFD1413FD099E0ACD3C97A0A4A4E7E04751556B76FE4D5117C5DC7424CD20DD4D5E75643D399C36E84DEC20F33C2781429084A78CB7C
Malicious:	false
Preview:	........`...j.n<..k.}<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}. =....(=....-=....5=....==....E=....L=....S=....Z=....[=....\=.....=.....=.....=.....=.....=.....=.....=.....>.....>.... >....6>....M>....b>....x>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>..*..>..+..>..,..?../.;?..0.@?..1.v?..2..?..3..?..4..?..5..?..6..@..7. @..>.4@..?.>@..N.Q@..g.^@..i.a@..j.e@..k.j@..l.p@...Zs@...Z.@...Z.@...Z[A...ZaA...Z.A...Z.A...Z.A...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z.C...Z#C...ZKC...Z\|C...Z.D...ZID...ZPD.. ZxD..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z4E..5Z@E..7ZVE..=ZZE..>ZpE..?Z.E..AZ.E..BZ.E..CZ.F..DZ.F..EZ F..FZ:F..GZ_F..HZ.F..IZXG..JZ.G..KZ.G..LZ.H..MZ.H..PZMH..QZ.H..RZ.I..SZ.I..TZ.I..VZ.J..WZ.J..XZ.J..YZ.K..ZZ.K..[Z?K..\Z\L..]Z.L..^ZSM.._Z.M..aZ.M..cZ.M..dZ.M..eZ.M..fZ.N..gZ4N..lZyN..mZ.N..nZ.O..oZ4O..pZGO..qZ.O..rZ.O..sZ8P..tZ.P..uZ.P..zZ_Q..{ZgQ..\|ZoQ..}ZrQ..~ZuQ...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z0R...ZWR...Z.R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	128272
Entropy (8bit):	5.810187874604264
Encrypted:	false
SSDEEP:	1536:hsS2h3j45qcD4pP7zoDtJ+17V3JIAixmcRbCN2lDfng+5XS/iRys8QYSXw:ShTnjzoDtJ+17vbN2lDfg+5XS/s8QYSA
MD5:	3CFD9DC564CFCC33CC5524711365C376
SHA1:	2E5016D2643017F37658262122974429F18625A2
SHA-256:	8BE34E4F8226C1DD4E725711DDD884EF4476560F7863EDCF378573DDE9DB3CEE
SHA-512:	6EE156D2FA3B6F601DF28E38968D0EAE2812D70B41333348DBECD833D5EE6FF944183F0EECDE96BE433CF1E98C8EC22D6A6D5AF5153145842175AB43C73533EF
Malicious:	false
Preview:	........U...j.X<..k.g<..l.r<..n.z<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....'=..../=....6=....==....D=....E=....F=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....&>....7>....>>....A>....B>....O>....\>....c>....k>....v>.....>.....>.....>.....>....>..+..>..,..>../..>..0..>..1.7?..2.E?..3.S?..4.p?..5..?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j..@..k.$@..l./@...Z4@...Z`@...Zy@...Z.A...Z.A...ZFA...ZXA...ZkA...Z.A...Z.A...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z.D...Z.D...Z.D...Z.D.. Z.D..!Z.D.."Z.E..#Z.E..$Z5E..%ZOE..&ZfE..,Z.E..5Z.E..7Z.E..=Z.E..>Z.E..?Z.E..AZ.F..BZ>F..CZQF..EZ`F..FZsF..GZ.F..HZ.G..IZdG..JZ.G..KZ.G..LZ.H..MZ#H..PZEH..QZ.H..RZ}I..SZ.I..TZ.I..VZ.I..WZcJ..XZ.K..YZ.K..ZZK..[ZNK..\ZOM..]Z?N..^Z.O.._ZGO..aZgO..cZnO..dZ\|O..eZ.O..fZ.O..gZ.O..lZ.P..mZ'P..nZ.P..oZ.P..pZ.P..qZ.P..rZNQ..sZ.Q..tZ.Q..uZ.R..zZ.R..{Z.R..\|Z.R..}Z.R..~Z.R...Z.R...Z.R...Z.R...Z.R...Z.R...Z.S...Z"S...ZFS...ZkS...Z.S...Z.S

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	116787
Entropy (8bit):	5.43022187707482
Encrypted:	false
SSDEEP:	1536:03mzdvvRxJpbiSB3CxjDqg5vszO52G+5JGAD4g8pOmPE7G6zH:ocdvvRxdC9DZszO5L+5/dl9
MD5:	30F3D0D91068CAC24144CC1232E2A15A
SHA1:	9640D3F787F3D0922FDCC44773393898E12ED865
SHA-256:	D1539E7D62F90DCEA42EF608A72E581F7E4FAD579DFB38A1942D4013EF933D92
SHA-512:	C5CC45E5092AE80E8BFD2536431483A99C013D9FB478982E2CC8E13AC1477B9E7478D86B4EE154106BCA78B5278E50B98003C796228BDD0774B250FE25FAAEED
Malicious:	false
Preview:	........\...j.f<..k.u<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=.... =....%=....-=....5=....==....D=....K=....R=....S=....T=....}=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....+>....2>....5>....6>....=>....F>....L>....O>....V>....a>....h>....l>.....>....>..+..>..,..>../..>..0..>..1..>..2..>..3..?..4."?..5.:?..6.l?..7.}?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.@...Z.@...Z.@...Z.@...Z.@...Z.A...ZAA...ZNA...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z;C...Z.C...Z.C...Z.C.. Z+D..!Z2D.."ZND..#ZVD..$ZmD..%Z\|D..&Z.D..,Z.D..5Z.D..7Z.D..=Z.D..>Z.D..?Z.D..AZ9E..BZbE..CZpE..DZ.E..EZ.E..FZ.E..GZ.E..HZ.F..IZ~F..JZ.F..KZ.F..LZ.G..MZG..PZ;G..QZ.G..RZUH..SZdH..TZrH..VZ.H..WZ.H..XZ\|I..YZ.I..ZZ.I..[Z.I..\Z.J..]ZeK..^Z.K.._Z(L..aZCL..cZKL..dZRL..eZYL..fZcL..gZ.L..lZ.L..mZ.M..nZ\|M..oZ.M..pZ.M..qZ.M..rZ#N..sZhN..tZ.N..uZ.N..zZjO..\|ZrO..}ZxO..~Z{O...Z.O...Z.O...Z.O...Z.O...Z.O...Z.O...Z.O...Z.P...Z2P...ZtP...Z.P

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	126214
Entropy (8bit):	5.492931083301909
Encrypted:	false
SSDEEP:	3072:EJh0BwyGwQstGhUzzfRfA8St2NYaBgZFE:EJaVGEfRIwY+gZ+
MD5:	52068F252AFB366AC622E92725EF2644
SHA1:	73D6934F08265FD5998F87B17AB6101DC87917F4
SHA-256:	5904068BB1213FCB8434ECE0A08D651166032AD86D53578278C43FFB91C83CA2
SHA-512:	DE56698B2AF71DDD01E782E65D4975A3F62225604B960B74DAADD44CDDA4D94757EF2965D366FC730DDD6C9D072FE8FB4B67CC071CF2950A032F1C9FCFACC3E6
Malicious:	false
Preview:	......../.8.j..<..k..<..l.&<..n..<..o.3<..p.@<..q.F<..r.U<..s.f<..t.o<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<....3=....D=....W=....i=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>.....>....'>....1>....E>....O>....X>....i>....p>....y>.....>....>..+..>..,..>../..>..0..>..1..>..2..?..3..?..4.5?..5.V?..6..?..7..?..>..?..?..?..N..?..g..?..i..?..j..?..k..@..l..@...Z.@...Z>@...ZY@...Z.A...Z#A...ZGA...Z]A...ZwA...Z.A...Z.A...Z.B...Z.B...Z.B...Z.B...Z.C...Z.C...Z;C...ZgC...Z.D...Z6D...Z@D.. ZmD..!ZwD.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z.E..5ZE..7Z:E..=ZCE..>ZSE..?ZbE..AZ.E..BZ.E..CZ.E..DZ.E..EZ.E..FZ.F..GZLF..HZ.F..IZcG..JZ.H..KZ.H..LZFH..MZWH..PZkH..QZ.I..RZ.I..SZ.I..TZ.I..VZ$J..WZ.J..XZ.K..YZ.K..ZZ K..[ZAK..\Z_L..]Z.L..^ZmM.._Z.M..aZ.M..cZ.M..dZ.N..eZ.N..fZ.N..gZRN..lZ.N..mZ.N..nZ\O..oZpO..pZ.O..qZ.O..rZ.P..sZbP..tZ.P..uZ.P..zZ.Q..\|Z.Q..}Z.Q..~Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z.R...Z.R...ZFR...ZqR...Z.R...Z.R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	221733
Entropy (8bit):	4.809579931823792
Encrypted:	false
SSDEEP:	6144:86R2vCi+hFMkDuntVF5IcRrl3ppSP3/5zFMeF+fY2hlL6Xa9YlXSAzG:N8vCi+hFMkDuntVF5IcRrl3ppSP3/5zY
MD5:	38440B98BFDF5ED496DA0F49D59534C0
SHA1:	1498D9207ECAF4923A47271E24C68A817041C82E
SHA-256:	B1F78DF8A7EDC914357A2E90BC8DC0AC46F4DF642BB22894569FE4905FB8EA0F
SHA-512:	95BA788FC2E1F07D54E398F1EC4D32C664CFB13118D46CB7AF7A993367E032B10DE84F3E604AB6E659D6410E2D736097EC5E9B3B002040C54412358F0EA10229
Malicious:	false
Preview:	........U...j.X<..k.g<..l.r<..n.z<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....'=..../=....6=....==....D=....E=....F=.....=.....=.....=....->....f>....h>....l>....\|>.....>.....>.....>.....>....'?....T?....[?....^?...._?....{?.....?.....?.....?.....?.....?.....?.....?....4@...I@..+.L@..,.j@../..@..0..@..1.WA..2.\|A..3..A..4..A..5.%B..6..B..7..B..>..C..?..C..N.5C..g.IC..i.LC..j.PC..k.UC..l._C...ZdC...Z.C...Z.C...ZE...Z@E...Z.E...Z.E...Z.E...ZWF...ZzF...Z.H...ZWH...ZgH...ZmH...Z.H...Z.H...Z.H...Z/I...ZyJ...Z.J...Z.J.. ZNK..!ZsK.."Z.K..#Z.K..$Z.K..%Z'L..&Z;L..,Z.L..5Z.L..7Z.L..=Z.M..>Z*M..?ZKM..AZ.M..BZ1N..CZWN..DZxN..EZ.N..FZ.N..GZIO..HZ<P..IZ.Q..JZ.R..KZ&R..LZ.R..MZ.R..PZ.R..QZ.S..RZ.U..SZ.U..TZ.U..VZ.V..WZ.W..XZ.W..YZ.W..ZZ.W..[ZAX..\Z6Z..]Z.[..^Z.\.._Z.\..aZ.\..cZ.\..dZ.]..eZ.]..fZ2]..gZ.]..lZ.]..mZc^..nZF_..oZ._..pZ._..qZ8`..rZ.`..sZ.a..tZ\b..uZ.b..zZ.c..{Z.c..\|Z.c..}Z.c..~Z.d...Z-d...Z\d...Z}d...Z~d...Z.d...Z.d...Z.d...Z.e...ZGe...Z.e

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	102178
Entropy (8bit):	5.470248741592977
Encrypted:	false
SSDEEP:	1536:tmCSXTzmWQWGmjrD0KDK4Rr3jSr5iBqgqQSOiJedMJrV9ZvVfm3ggl+1hK:tQX/mpmjEKzHBqgAbu3ggl+1s
MD5:	BDC99FD2544CE33289A113AD574DE739
SHA1:	A5AA462CDF5007AC2D73E4E70BCA32BB88A65B65
SHA-256:	A120AD94AA02311F75DA9893B9B1DC76095953079E0892F6983BC2FAA596364A
SHA-512:	2BBE52DA33A34E9F5461743DCF2ADCF21356B39277F62B24FD53434207FE640949389D83EA9AB7D3D7B893CD32E2857730A93B5CE6D8057144341B982D40149F
Malicious:	false
Preview:	........c...j.t<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}.&=.....=....3=....;=....C=....K=....R=....Y=....`=....a=....b=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....,>....3>....6>....7>....?>....G>....N>....S>....X>....c>....g>....n>.....>..*..>..+..>..,..>../..>..0..>..1..>..2..?..3..?..4..?..5.6?..6.h?..7.x?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.?...ZW@...Z\@...Zz@...Z.@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z;B...ZUB...Z[B.. ZuB..!Z}B.."Z.B..#Z.B..$Z.B..%Z.B..&Z.B..,Z.C..5Z.C..7Z(C..=Z,C..>Z6C..?Z?C..AZ.C..BZ.C..CZ.C..DZ.C..EZ.C..FZ.C..GZ.C..HZKD..IZ.D..JZ.D..KZ.E..LZ+E..MZ7E..PZHE..QZ.E..RZyF..SZ.F..TZ.F..VZ.F..WZ.G..XZ}G..YZ.G..ZZ.G..[Z.G..\Z.H..]Z.I..^Z.I.._Z.I..aZ.I..cZ.I..dZ.I..eZ.I..fZ.I..gZ.J..lZNJ..mZwJ..nZ.J..oZ.J..pZ.J..qZ.K..rZlK..sZ.K..tZ.K..uZ.L..zZ.L..{Z.L..\|Z.L..}Z.L..~Z.L...Z.L...Z.L...Z.L...Z.L...Z.L...Z.L...Z.M...Z.M...ZHM...Z.M

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	102993
Entropy (8bit):	5.463197444756606
Encrypted:	false
SSDEEP:	1536:SQo63sGGuW5Rt0FDSED0FhiL2tr/OSa5dBqg7GSO0JedMVrBphVfD3ggl+S4jwh:vo6cJl8DSTh1QBqg5fb3ggl+Sgwh
MD5:	0BB857860D8C9AB6D617CEA5A5BD4D00
SHA1:	351B744D95846BFF2CE5F542FEC2E87439AA0F8B
SHA-256:	5C56DF9699FC7E8F09EC81421E50A6264CDE055E822F5A8CD9BB1EDB3066D816
SHA-512:	33FB73CFFBB6781488CEDBCA4C92A7E4F66923A799BEEB7F5CBA58DBC23BA8F5130F63A7DAC7114E3C3EF6F1DF87884FBEB8858BC7604AEC9449FDFD16C25078
Malicious:	false
Preview:	........p...j..<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..=..w..=..y..=..z.(=..\|..=..}.@=....H=....M=....U=....]=....e=....l=....s=....z=....{=....\|=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....1>....F>....M>....P>....Q>....Y>....a>....h>....m>....r>....}>.....>.....>.....>..*..>..+..>..,..>../..>..0..>..1..?..2..?..3.$?..4.8?..5.O?..6..?..7..?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.@...Zp@...Zu@...Z.@...Z.@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z.B...ZdB...Z~B...Z.B.. Z.B..!Z.B.."Z.B..#Z.B..$Z.B..%Z.B..&Z.C..,Z8C..5ZAC..7ZPC..=ZTC..>Z^C..?ZgC..AZ.C..BZ.C..CZ.C..DZ.C..EZ.C..FZ.C..GZ.D..HZjD..IZ.D..JZ.E..KZ&E..LZKE..MZWE..PZlE..QZ.E..RZ.F..SZ.F..TZ.F..VZ.F..WZ;G..XZ.G..YZ.G..ZZ.G..[Z.G..\Z.H..]ZcI..^Z.I.._Z.J..aZ,J..cZ2J..dZ<J..eZCJ..fZNJ..gZjJ..lZ.J..mZ.J..nZ K..oZ4K..pZDK..qZlK..rZ.K..sZ.L..tZHL..uZlL..zZ.L..{Z.L..\|Z.L..}Z.M..~Z.M...Z.M...Z,M...Z?M...Z@M...ZKM...ZNM...ZeM...Z.M...Z.M...Z.M

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	123881
Entropy (8bit):	5.370631232960025
Encrypted:	false
SSDEEP:	1536:q7C9erEhjRb4Zr4h3mxaXGQ17L46ddPcHYKCRKfKW0JWFsMH5BnVZNove:Uf2l8khYcM6aZ
MD5:	D2501A67FAA196168F0AFAB9B9D4B34A
SHA1:	0D8FAE5CADCB2BCD4AA1236CE3139EAA742F2B40
SHA-256:	BAE07DBA80C44DFBCCFB1F4523E94326419C782AC40406BFD5CE2FF456F76CD1
SHA-512:	B8293FAD2D125FB2730C619E401E40A80B070648D969D00F5E050B69833CED16B264D54880BE92D9F40A60528BF208058955E1E8CE7D6A2FF8314AC6CEF2FA7B
Malicious:	false
Preview:	........^...j.j<..k.y<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=....$=....)=....1=....9=....A=....H=....O=....V=....W=....X=....~=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....6>....N>....U>....X>....Y>....b>....k>....t>....z>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.S?..2.g?..3.v?..4..?..5..?..6..?..7..@..>.(@..?.2@..N.G@..g.S@..i.V@..j.Z@..k._@..l.g@...Zl@...Z.@...Z.@...ZpA...ZxA...Z.A...Z.A...Z.A...Z.A...Z.B...Z.B...Z.C...Z.C...Z.C...Z C...Z.C...ZJC...Z}C...Z.D...ZHD...ZQD.. Z{D..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z.E..5Z&E..7Z@E..=ZGE..>ZdE..?ZvE..AZ.E..BZ.E..CZ.F..DZ.F..EZ.F..FZ<F..GZjF..HZ.F..IZUG..JZ.G..KZ.H..LZ%H..MZ8H..PZXH..QZ.H..RZ.I..SZ.I..TZ.I..VZ.J..WZ.J..XZ.K..YZ.K..ZZ.K..[Z:K..\Z.L..]Z.L..^Z.M.._Z~M..aZ.M..cZ.M..dZ.M..eZ.M..fZ.M..gZ.M..lZ?N..mZoN..nZ.N..oZ.N..pZ.O..qZ;O..rZ.O..sZ.O..tZPP..uZ{P..zZKQ..{ZTQ..\|Z]Q..}Z`Q..~ZdQ...ZzQ...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z,R...ZzR

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	125156
Entropy (8bit):	5.338264798177997
Encrypted:	false
SSDEEP:	1536:rel9Q3x8LDdrwwZ72bev4dYSiE/XFjqh3viyTcHVgFW9XlhgoYKWRux6PZ3xvJ:AQx8fNwwZ7jRSiEFd5I4x6PZ3z
MD5:	FB3C2FB95E8F0C38D645CB4A554B2BF4
SHA1:	E200E0DA7A39FB9CA6FF891ACFFF31DAEB7F703E
SHA-256:	2F40AF831646692915F1F39F41C34E4E276EED51BB15B5F043F553C47AF49037
SHA-512:	0364AFBEDAA2986B9C763EA9919FA23AF0F9703568B12A8EF0CCF43E9EC34755ACA7C35C47D08FC26495F63AED7CC987E7AA1749EFA3103C047DD65BA3738250
Malicious:	false
Preview:	........`...j.n<..k.}<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}. =....(=....-=....5=....==....E=....L=....S=....Z=....[=....\=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>....F>....^>....e>....h>....i>....r>....{>.....>.....>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.T?..2.h?..3.w?..4..?..5..?..6..@..7..@..>.&@..?.0@..N.E@..g.Q@..i.T@..j.X@..k.a@..l.i@...Zo@...Z.@...Z.@...ZRA...ZZA...Z.A...Z.A...Z.A...Z.A...Z.A...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z-C...Z[C...Z.C...Z D...Z)D.. ZZD..!ZqD.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z.E..5Z$E..7Z>E..=ZEE..>ZbE..?ZqE..AZ.E..BZ.E..CZ.F..DZ.F..EZ.F..FZ6F..GZfF..HZ.F..IZMG..JZ.G..KZ.G..LZ.H..MZ%H..PZDH..QZ.H..RZzI..SZ.I..TZ.I..VZ.I..WZ?J..XZ.J..YZ.J..ZZ.J..[Z.J..\Z.K..]ZpL..^Z.L.._Z6M..aZ_M..cZgM..dZsM..eZ}M..fZ.M..gZ.M..lZ.N..mZ=N..nZ.N..oZ.N..pZ.N..qZ)O..rZ.O..sZ.O..tZYP..uZ.P..zZ4Q..{Z=Q..\|ZFQ..}ZIQ..~ZMQ...ZcQ...Z~Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z\R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	112676
Entropy (8bit):	5.455138982379964
Encrypted:	false
SSDEEP:	1536:fMeTTURxwKul73Dyf4xVyNlysg9jXeuLECstZFsPQWcu:EkURql7Gf4xVLjtLEtwPQWB
MD5:	C76DB3385190C6840315C4497E40258A
SHA1:	34F1AEF2BA2925BEBC5DCDB70E5B6C1A138A5C46
SHA-256:	E8AF084EF5E1062C5966DD7802074AC24F3672DC3C9B9C5453A397644727191F
SHA-512:	90A870369D307758B33D74E6213676D65C2D332F42577C8AFF23D96B512F3C2A2BDACE8D6D9007F88B9175EADC6F2AE28B498B1265550849FF9317465A37AD29
Malicious:	false
Preview:	........g...j.\|<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..=..y..=..z..=..\|..=..}..=....6=....;=....C=....K=....S=....Z=....a=....h=....i=....j=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.... >..../>....D>....X>...._>....b>....c>....l>....v>....\|>.....>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..>..0..?..1.5?..2.@?..3.L?..4.c?..5..?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j..@..k..@..l.!@...Z,@...ZP@...Zl@...Z.A...Z.A...ZCA...ZYA...ZqA...Z.A...Z.A...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z.C...Z.C...Z.C.. Z.C..!Z.D.."Z%D..#Z+D..$Z9D..%ZUD..&ZiD..,Z.D..5Z.D..7Z.D..=Z.D..>Z.D..?Z.D..AZ+E..BZQE..CZeE..DZqE..EZwE..FZ.E..GZ.E..HZ.F..IZzF..JZ.F..KZ.F..LZ.G..MZ,G..PZEG..QZ.G..RZgH..SZvH..TZ.H..VZ.H..WZ3I..XZ.I..YZ.I..ZZ.I..[Z.I..\Z.J..]ZQK..^Z.K.._Z.K..aZ.L..cZ.L..dZ.L..eZ$L..fZ6L..gZZL..lZ.L..mZ.L..nZ M..oZ@M..pZRM..qZ.M..rZ.M..sZ"N..tZiN..uZ.N..zZ.O..\|Z.O..}Z.O..~Z.O...Z)O...ZAO...ZQO...ZRO...ZeO...ZhO...Z.O...Z.O...Z.O...Z-P...ZMP

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	177923
Entropy (8bit):	5.1021482199072645
Encrypted:	false
SSDEEP:	3072:8OWfrcwA+hsXv94Rawpa8k+6NS9/W2ESEmSzR2XQmN4o6XsHdBfv7fDb8YIO/ECc:srcwAXXV4Rawpa8k+6NS9/W2ESEmSV2k
MD5:	1E18D44BE2ED83CEED8C1016C63012E3
SHA1:	FBE7E9C833A07972BA8C8296CFEA48E9EC423347
SHA-256:	ABFFB8FFBA9F51664D785E96C38A686E40FC0B88CFDE82D96CE57B2350870F85
SHA-512:	B56FAC3798421C489271F39353023A02CFA74EF44A185767547BEB7A41557E91BD07C1D8C526A110DD1D97DF23D24D4B0EC453116FFE7483BE0C623B98E51B65
Malicious:	false
Preview:	........%.B.j..;..k..<..l..<..n..<..o..<..p.,<..q.2<..r.A<..s.R<..t.[<..v.p<..w.}<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....=....H=....d=.....=.....=.....=.....=.....=.....=.....=.....>....3>....T>....l>....s>....v>.....>.....>.....>.....>.....>.....>.....>.....>.....?..*.)?..+.,?..,.J?../.n?..0.\|?..1..?..2..?..3..?..4..@..5.G@..6..@..7..@..>..A..?.!A..N.?A..g.IA..i.LA..j.PA..k.UA..l._A...ZiA...Z.A...Z.A...Z.B...Z.B...Z/C...ZVC...Z.C...Z.C...Z.C...Z.E...Z.E...Z.F...Z.F...Z:F...ZHF...Z.F...Z.F...Z.G...Z.H...Z.H.. ZlH..!Z.H.."Z.H..#Z.H..$Z.H..%Z.I..&Z2I..,Z.I..5Z.I..7Z.I..=Z.I..>Z.I..?Z.I..AZmJ..BZ.J..CZ.J..DZ.J..EZ.J..FZ.K..GZpK..HZ\L..IZ1M..JZ.N..KZ%N..LZjN..MZ{N..PZ.N..QZ.O..RZ.P..SZ.P..TZ.Q..VZlQ..WZ+R..XZ.S..YZ.S..ZZ<S..[ZkS..\Z.U..]Z.V..^Z.W.._Z"X..cZaX..dZ}X..eZ.X..fZ.X..gZ.X..lZmY..mZ.Y..nZSZ..oZ\|Z..pZ.Z..qZ.Z..rZm[..sZ.[..tZc\..uZ.\..zZl]..\|Zv]..}Z\|]..~Z.]...Z.]...Z.]...Z.]...Z.]...Z.^...Z.^...Z3^...Zr^...Z.^...Z/_...ZS_...Z._...Z._...Z._

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	114811
Entropy (8bit):	5.425518522436933
Encrypted:	false
SSDEEP:	3072:m6TvhQlWmiTUqWUEv4jZEEZ18JloRW/YmjwjNM17o4pf:m6Thg79EZ18Jv/mif
MD5:	238FC3C25113C5AE8C787FDC45C7A099
SHA1:	60DE72538B37C4B247BB9851E11B2C0CF667DCF5
SHA-256:	CCE38E913043A1E65E62F477B3EF8BD1358DB451396A596FD56FA96D396468FB
SHA-512:	DD27D5CEDF928B590725224EE00A1E8C81F3052284CD0C8E54E0F59FE4AFA4C9BB2ED93D18F59830CBCA9BFC0F602711197F977B1B4943459DEEF5FBD8F2A149
Malicious:	false
Preview:	........T...j.V<..k.e<..l.p<..n.x<..o.}<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....%=....-=....4=....;=....B=....C=....D=....n=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....%>....,>..../>....0>....9>....A>....H>....M>....T>....c>....k>....s>.....>..*..>..+..>..,..>../..>..0..>..1..?..2.#?..3.2?..4.N?..5.h?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j..@..k. @..l.(@...Z-@...ZN@...Zk@...Z.A...Z.A...ZCA...ZZA...ZrA...Z.A...Z.A...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z~C...Z.C...Z.C.. Z.C..!Z.C.."Z.D..#Z.D..$Z.D..%Z-D..&Z:D..,ZrD..5Z{D..7Z.D..=Z.D..>Z.D..?Z.D..AZ.D..BZ!E..CZ3E..DZDE..EZJE..FZgE..GZ.E..HZ.E..IZZF..JZ.F..KZ.F..LZ.F..MZ.G..PZ,G..QZ.G..RZkH..SZ}H..TZ.H..VZ.H..WZ.I..XZ.I..YZ.I..ZZ.I..[Z.I..\Z.J..]Z5K..^Z.K.._Z.K..aZ.K..cZ.K..dZ.L..eZ.L..fZ&L..gZGL..lZ.L..mZ.L..nZ.M..oZ.M..pZ'M..qZOM..rZ.M..sZ.M..tZ,N..uZNN..zZ.N..\|Z.N..}Z.N..~Z.N...Z.N...Z.O...Z.O...Z.O...Z(O...Z+O...Z@O...ZmO...Z.O...Z.O...Z.O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	129075
Entropy (8bit):	5.177003460602694
Encrypted:	false
SSDEEP:	1536:z1q909ZywHYfcVrLehf3QzeNvuNpEWnG/gilPgTAM64CzPE2j6/a12uKlu9IdXpU:zh9ZywHE8IfKwPgTAaCz36/hpp25
MD5:	40BDDAF97F64DFEA9EBAFC7F82166F80
SHA1:	90D1FDE3C0B27D2184F0353991259C2A92C7820C
SHA-256:	39A9D63736E7B4593FC6873ED3C19D45FBF9EB78A012BFDCEE0FEA5906EBC5B2
SHA-512:	D1E61C53E09A0DC50EDF5ABA5CF286A251EE88421AA2CD49332B70A5859646605ECB7D0BB97EA7242D14A18742E23DA0A14C04B0B99B57A466EC87F4F66B897E
Malicious:	false
Preview:	........i...j..<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..=..y..=..z..=..\|. =..}.2=....:=....?=....G=....O=....W=....^=....e=....l=....m=....n=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....8>....O>....h>....o>....r>....s>....}>.....>.....>.....>.....>.....>.....>.....>.....>....>..+..>..,..?../..?..0.7?..1.k?..2.\|?..3..?..4..?..5..?..6..?..7..@..>..@..?.6@..N.I@..g.T@..i.W@..j.[@..k.`@..l.n@...Zs@...Z.@...Z.@...ZGA...ZNA...ZzA...Z.A...Z.A...Z.A...Z.A...Z1C...ZFC...ZNC...ZTC...ZeC...ZpC...Z.C...Z.C...Z9D...Z`D...ZiD.. Z.D..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.E..,ZAE..5ZNE..7Z]E..=ZcE..>ZsE..?Z.E..AZ.E..BZ.E..CZ.F..DZ.F..EZ$F..FZ:F..GZbF..HZ.F..IZ7G..JZ.G..KZ.G..LZ.G..MZ.H..PZH..QZ.H..RZ\|I..SZ.I..TZ.I..VZ.I..WZFJ..XZ.J..YZ.J..ZZ.K..[Z%K..\Z.L..]Z]M..^Z.N.._ZMN..aZnN..cZxN..dZ.N..eZ.N..fZ.N..gZ.N..lZ.O..mZ;O..nZ.O..oZ.O..pZ.O..qZ.P..rZrP..sZ.P..tZ.Q..uZEQ..zZ.Q..{Z.Q..\|Z.Q..}Z.Q..~Z.R...Z.R...Z6R...ZKR...ZLR...Z]R...Z`R...Z.R...Z.R...Z.R...Z S

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	134199
Entropy (8bit):	5.379916231058734
Encrypted:	false
SSDEEP:	3072:C1EuvO5J3cQRLbJKSG9+l9Z85NtMsEMpSwYRHD+IzKByroFDuFcVRSfwgO35JNP:C1+5RcQRLdFG9+l9Z85NtXEMpWRHD+Is
MD5:	C3095CE1E88B0976BA7BEF183D047347
SHA1:	B14CFBF6E46AC1F189595FC09660178525301138
SHA-256:	66488DC10517B6E3638686BE95B430477A39304E92AC45DFE62B58CAE3A77272
SHA-512:	29F47B1EFF4681A9A17A50D6E82D63C22FE7BFE4CEB79862E81D8CD9F96FA38E225978B4C4B1F8E55B220235B91652C776FA8D2E559C68942C6CCF402812A421
Malicious:	false
Preview:	........S...j.T<..k.c<..l.n<..n.v<..o.{<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....#=....+=....2=....9=....@=....A=....B=....g=....w=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>....,>....3>....6>....7>....?>....G>....P>....V>....]>....p>....v>....}>.....>..*..>..+..>..,..>../..>..0..>..1.+?..2.>?..3.H?..4.f?..5..?..6..?..7..?..>..?..?..@..N..@..g.$@..i.'@..j.+@..k.0@..l.6@...Z9@...Zk@...Z.@...Z.A...Z%A...ZIA...Z`A...Z\|A...Z.A...Z.A...Z.B...Z.C...Z.C...Z C...Z0C...Z;C...ZsC...Z.C...Z$D...ZSD...ZUD.. Z.D..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.E..,Z[E..5ZdE..7ZzE..=Z.E..>Z.E..?Z.E..AZ.F..BZ3F..CZEF..EZVF..FZzF..GZ.F..HZ6G..IZ.G..JZYH..KZuH..LZ.H..MZ.H..PZ.H..QZ\I..RZ,J..SZ<J..TZXJ..VZ.J..WZ K..XZ.K..YZ.K..ZZ.K..[Z'L..\Z.M..]Z.N..^ZpO.._Z.O..cZ.O..dZ.O..eZ.P..fZ.P..gZDP..lZ.P..mZ.P..nZ5Q..oZVQ..pZiQ..qZ.Q..rZ.R..sZ.R..tZ.R..uZ.S..zZ.S..{Z.S..\|Z.S..}Z.S..~Z.S...Z.T...Z.T...Z,T...Z-T...ZDT...ZOT...ZnT...Z.T...Z.T...Z.U...Z.U...Z7U

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	4.393538272972337
Encrypted:	false
SSDEEP:	3072:EBv5Iqx39v+1A1A626irP8n3M8IrU35YdO3C36zoYimPVO4cGPX/grRHe5GmdRPM:EXIuVQf
MD5:	63A7FDC4EADF8EF1C35C72468A0CE33F
SHA1:	E8D064F0E9C8A6A8C6CCB036711E292D011D9466
SHA-256:	E549FF4E5A094D04C2CE7BC6FD68BEA1F03E935437BF164BEBB6191C133FA70C
SHA-512:	0A097FF875132A984545EC677B04F97785F14C38A1DF487CFB4722CDEA07D14E1E88FCFF7D58B82FA53F05F4EBA779A95EF320B5A91692097726D0385A26A456
Malicious:	false
Preview:	........C.$.j.4<..k.C<..l.N<..n.V<..o.[<..p.h<..q.n<..r.}<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....=.....=.....=.....=.... =....!=...."=.....=.....=.....=.....>....F>....H>....T>.....>.....>.....>.....>.....>....$?....H?....O?....R?....T?....m?.....?.....?.....?.....?.....?.....?.....@....@@..*.h@..+.k@..,..@../..@..0..@..1.FA..2.]A..3..A..4..A..5..A..6.FB..7..B..>..B..?..B..N.#C..g.3C..i.6C..j.:C..k.?C..l.MC...ZRC...Z.C...Z.C...Z"E...Z>E...Z.E...Z.E...Z.F...Z.F...Z.F...Z.I...Z.I...Z.I...Z.I...Z J...Z2J...Z.J...Z.J...Z.L...ZVL...ZrL.. Z.L..!Z.L.."Z.M..#Z(M..$ZNM..%Z.M..&Z.M..,ZrN..5Z.N..7Z.N..=Z.N..>Z.N..?Z.O..AZ.O..BZ.P..CZ)P..DZRP..EZeP..FZ.P..GZ.Q..HZ.Q..IZ.R..JZ.S..KZ!T..LZ.T..MZ.T..PZ.T..QZ.V..RZ.W..SZ.X..TZHX..VZ.X..WZ.Y..XZ.[..YZO[..ZZo[..[Z.[..\Z._..]Z.a..^Z;b.._Z.b..aZ#c..cZ3c..dZLc..eZ^c..fZ.c..gZ.c..lZ.d..mZ.d..nZ.e..oZ&f..pZXf..qZ.f..rZ.g..sZlh..tZ#i..uZki..zZ.j..{Z.j..\|Z.j..}Z.j..~Z.k...ZZk...Z.k...Z.l...Z.l...Z<l...Z?l...Z.l...Z.l...Z0m...Z.m

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	155095
Entropy (8bit):	4.7604283071352995
Encrypted:	false
SSDEEP:	1536:/QTfl862UVk3NspwWHHe1AqEgS+0HgmGgnQ0MWWWmXWOnw157YGwq1pyP5m3XT9Z:U862up1z+WgLcMzXk5lVB3XTnw6jzOIt
MD5:	6A02A37E1CA3215FA9EE0E1B0FBCF5E7
SHA1:	89A8A126C0BBF536AC58E29FC50E045FB1B88220
SHA-256:	F5CF34CE58B7F0D450936981AA7FFA060821403E6768EEE3746EA4FFC9193986
SHA-512:	6607EB2329B81F1EAF0ED3A564EDDCB30E6AB59229F2FBF6FD3D2140FFAA8853A330EDA627A4458EF6BB06F32C5183EDDA869E34CD4EAD1F87F88D5C622C1A16
Malicious:	false
Preview:	........7.0.j..<..k.+<..l.6<..n.><..o.C<..p.P<..q.V<..r.e<..s.v<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....=.....=.....=.....=....Z=....q=.....=.....=.....=.....=.....=.....=.....=.....>.... >....3>....K>....a>....h>....k>....l>....v>.....>.....>.....>.....>.....>.....>.....>.....>..*..?..+..?..,.#?../.4?..0.A?..1.~?..2..?..3..?..4..?..5..?..6.=@..7.V@..>.k@..?.\|@..N..@..g..@..i..@..j..@..k..@..l..@...Z.@...Z.@...Z.A...Z.A...Z.A...Z0B...ZPB...ZjB...Z.B...Z.B...ZYE...ZnE...ZxE...Z.E...Z.E...Z.E...Z.E...Z.F...Z.F...Z'G...Z1G.. ZyG..!Z.G.."Z.G..#Z.G..$Z.G..%Z.G..&Z.H..,ZWH..5ZdH..7ZyH..=Z.H..>Z.H..?Z.H..AZ.I..BZII..CZ^I..DZwI..EZ.I..FZ.I..GZ.I..HZxJ..IZ.K..JZ.K..KZ.K..LZ.K..MZ.L..PZ+L..QZ.L..RZ.M..SZ.M..TZ.N..VZVN..WZ.N..XZ.O..YZ.O..ZZ.P..[Z@P..\Z.R..]Z.S..^Z&U.._Z.U..aZ.U..cZ.U..dZ.U..eZ.U..fZ.U..gZ&V..lZ.V..mZ.V..nZ3W..oZpW..pZ.W..qZ.W..rZMX..sZ.X..tZ.Y..uZ1Y..zZ.Y..{Z.Y..\|Z.Y..}Z.Z..~Z.Z...Z2Z...ZPZ...ZjZ...ZkZ...Z.Z...Z.Z...Z.Z...Z.Z...Z![...Z.[

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	259197
Entropy (8bit):	4.368162716094267
Encrypted:	false
SSDEEP:	3072:lUGMqnwEnqz5cwfKSIv8Fj3cvEVhYDXoWkO/S/Ffm9NLMILORvTHIf+ovazBKfzn:lCqn01g
MD5:	F38367DCC09779C27A7B24A8B8D9E3DE
SHA1:	D50FB715F9DE8C613330D451619404C0A16DBFF1
SHA-256:	62AA4FE12B03A7940BED60DC17764C7E413236F078879F984FCF56FC6FD682B7
SHA-512:	90BCA68B224249DF6314934C1AB488AAFEA5F2D002DCBF4EC7C5CA8BD118EE619B9BA16E795394F39E9391F7F94B493846F09EC524359A009B5633BEC6528154
Malicious:	false
Preview:	........5.2.j..<..k.'<..l.2<..n.:<..o.?<..p.L<..q.R<..r.a<..s.r<..t.{<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....=.....=.....=.....=.....=.....=.....>....;>....=>....A>....g>....z>.....>.....>.....>.....?....>?....E?....H?....J?....c?....\|?.....?.....?.....?.....?.....@....'@....O@...n@..+.q@..,..@../..@..0..@..1.bA..2..A..3..A..4..A..5..B..6.qB..7..B..>..C..?..C..N.SC..g.vC..i.yC..j.}C..k..C..l..C...Z.C...ZaD...Z.D...Z.F...Z.G...ZmG...Z.G...Z.G...Z.H...Z.H...Z.K...Z6L...ZBL...ZTL...Z.L...Z.L...Z.M...Z.M...Z5O...Z.O...Z.O.. ZqP..!Z.P.."Z.Q..#ZGQ..$Z.Q..%Z.Q..&Z.Q..,Z.R..5Z.R..7Z.R..=Z.R..>Z.S..?Z?S..AZ.S..BZDT..CZtT..DZ.T..EZ.T..FZ.U..GZ}U..HZtV..IZ^W..JZUX..KZ.X..LZ.X..MZ.X..PZ0Y..QZdZ..RZ.\..SZ)\..TZj\..VZ.]..WZ8^..XZO_..YZ._..ZZ._..[Z.`..\Z.b..]Zhd..^Z.e.._Z!f..aZhf..cZ~f..dZ.f..eZ.f..fZ.f..gZpg..lZ.h..mZ.i..nZ.i..oZ.j..pZJj..qZ.j..rZjk..sZ:l..tZ.m..uZ.m..zZ.n..\|Z.n..}Z.o..~Z.o...ZYo...Z.o...Z.o...Z.o...Z'p...Zp...Z.p...ZSq...Z.q...Z@r...Zzr

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	122655
Entropy (8bit):	5.5086846674021475
Encrypted:	false
SSDEEP:	3072:wExtK0dFKR0AGCMxleW+blEdp9lLnMU2EgI7MMoqa7DwOx9s:wstK0TV
MD5:	6F92235E6BA003AF925A2D6584AFD27D
SHA1:	3CEBA61E9C2975466B6244188F5EA72AAF042FC7
SHA-256:	479DC4F75A889D45F62B4DDB6EB48F21C473E37875468C9C26D928A263E15840
SHA-512:	82F2642DFF4400704C15C2FA02D0EC74ED3FE888DC835447C1AFCE7463DEE8F480BB81BE358C306E681625864A6D25E5CD6C96252B8A56E6FC62014B3AA4D26A
Malicious:	false
Preview:	........]...j.h<..k.w<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=...."=....'=..../=....7=....?=....F=....M=....T=....U=....V=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>....5>....8>....9>....D>....P>....U>....\>....d>....p>....v>....~>.....>..*..>..+..>..,..>../..>..0..>..1..?..2.1?..3.@?..4.]?..5.{?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j..@..k.!@..l.)@...Z.@...ZV@...Zs@...Z.A...Z.A...Z9A...ZJA...Z[A...Z.A...Z.A...Z@C...ZTC...Z[C...ZaC...ZvC...Z~C...Z.C...Z.C...ZcD...Z.D...Z.D.. Z.D..!Z.D.."Z.E..#Z.E..$Z.E..%Z1E..&ZME..,Z\|E..5Z.E..7Z.E..=Z.E..>Z.E..?Z.E..AZ.F..BZ>F..CZSF..DZhF..EZnF..FZ.F..GZ.F..HZ.G..IZ~G..JZ.G..KZ.G..LZ.H..MZ&H..PZ:H..QZ.H..RZtI..SZ.I..TZ.I..VZ.I..WZQJ..XZ.K..YZ&K..ZZ2K..[ZQK..\ZNM..]Z?N..^Z.O.._ZSO..aZrO..cZzO..dZ.O..eZ.O..fZ.O..gZ.O..lZ.P..mZ2P..nZ.P..oZ.P..pZ.P..qZ.P..rZNQ..sZ.Q..tZ.Q..uZ.R..zZ.R..\|Z.R..}Z.R..~Z.R...Z.R...Z.R...Z.R...Z.S...Z.S...Z.S...Z>S...ZoS...Z.S...Z.S...Z.S

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	132987
Entropy (8bit):	5.6320188893900145
Encrypted:	false
SSDEEP:	3072:7qlRS3jgiHxwfRHiGhnq6wdAS6sdpEsLK5M3ICm:URYoxiGjC6sdpEB63ICm
MD5:	6896E8E2C471319BC24E224EED1315A9
SHA1:	F5B40F4A04C76C0187D293B07BF1CF8F21503DE2
SHA-256:	D08C2B3C8A5E3A69F01306318E8734843D508177218303765920E1E250FE80EE
SHA-512:	7B283CCC95F2D839FA4FCF64A9F89510ACEDEB1DEE1AB486C79059034CEA3EA49ED1D0A533D3944F1F6B8374FDCB6DE870575A9E44A576196E183B4584FE0A16
Malicious:	false
Preview:	........V...j.Z<..k.i<..l.t<..n.\|<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=....!=....)=....1=....8=....?=....F=....G=....H=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....3>....S>....x>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....?....?..+..?..,.,?../.=?..0.G?..1.~?..2..?..3..?..4..?..5..?..6..@..7.)@..>.J@..?.W@..N.j@..g.x@..i.{@..j..@..k..@..l..@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.B...Z B...Z`B...ZyB...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z.D...Z.D...Z.D...Z.D.. Z.E..!Z.E.."Z.E..#Z5E..$ZKE..%ZaE..&ZwE..,Z.E..5Z.E..7Z.E..=Z.E..>Z.E..?Z.F..AZDF..BZjF..CZzF..DZ.F..EZ.F..FZ.F..GZ.F..HZCG..IZ.G..JZ/H..KZEH..LZoH..MZ.H..PZ.H..QZ6I..RZ.J..SZ.J..TZJ..VZ_J..WZ.J..XZVK..YZiK..ZZvK..[Z.K..\Z.L..]Z*M..^Z.M.._Z.M..aZ.N..cZ.N..dZ1N..eZ>N..fZUN..gZ.N..lZ.N..mZ.N..nZiO..oZ.O..pZ.O..qZ.O..rZbP..sZ.P..tZ.Q..uZIQ..zZ.Q..{Z.R..\|Z.R..}Z.R..~Z!R...Z9R...ZTR...ZeR...ZfR...ZzR...Z}R...Z.R...Z.R...Z.S...Z\S

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	111043
Entropy (8bit):	5.353555595460344
Encrypted:	false
SSDEEP:	1536:IiC3VKMLZ/Qcr95/SWDEmIvUwRmNEBce0iBSX1CPWsAzb2ZVLRricCFVdy58:HC3VR9/QK95KWsce018WsAzaZV5icC7L
MD5:	E40CB2F3B4DB379E4D187AEEF0DFD300
SHA1:	537B1EBC615C980C89BBE2B9E91A11199FA7D6A6
SHA-256:	3339EF011C9BB64868DA94ADB25F4490ACBC7F893E4337DBFE2797754CD659F5
SHA-512:	B87464460077AA55FEB92ECA8ED23D9A61829378BAE7890C8A95DAC5FCD735B145D65661F27FACFE2586FCAA169692B00D8EE8DD505DC44BFF7F7FD090F3E96C
Malicious:	false
Preview:	........P...j.N<..k.]<..l.h<..n.p<..o.u<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=.....=....%=....,=....3=....:=....;=....<=...._=....m=....z=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>.....>....&>.....>....6>....;>....A>....M>....T>....X>....s>..*.~>..+..>..,..>../..>..0..>..1..>..2..>..3..?..4."?..5.4?..6.j?..7.}?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.@...Z.@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.B...Z.B...Z#B...Z)B...Z?B...ZFB...Z]B...Z.B...Z.B...Z#C...Z+C.. ZWC..!ZdC.."Z.C..#Z.C..$Z.C..%Z.C..&Z.C..,Z.D..5Z.D..7Z D..=Z&D..>Z3D..?Z?D..AZzD..BZ.D..CZ.D..DZ.D..EZ.D..FZ.D..GZ.E..HZnE..IZ.E..JZJF..KZ]F..LZ{F..MZ.F..PZ.F..QZ9G..RZ.G..SZ.H..TZ.H..VZ8H..WZ.H..XZ.I..YZ.I..ZZ-I..[ZLI..\Z)J..]Z.J..^Z.K.._ZWK..aZ{K..cZ.K..dZ.K..eZ.K..fZ.K..gZ.K..lZ.K..mZ'L..nZ}L..oZ.L..pZ.L..qZ.L..rZ#M..sZlM..tZ.M..uZ.M..zZWN..{ZaN..\|ZkN..}ZpN..~ZuN...Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.O...Z8O...Z.O...Z.O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	123112
Entropy (8bit):	5.269363682404934
Encrypted:	false
SSDEEP:	3072:p28N5TAO3OEyDhP8yN4tA7kxAjidIPlPhR40Juz:pLN5TAO3OzlkyN4tA7kxAjikZR4euz
MD5:	4DB28560440F3481EF20FCE0822574E2
SHA1:	C8A58111C14CAC74BC928F50FB5856B6CF09B985
SHA-256:	50785008D5068D506566D09A839731263D0527F361D29F4A279DAD78AD0BB891
SHA-512:	01D669386ABE35AA6D5EFAEA4DA352FDAFB02EF084D9DF22B3545960B395571ED5FC421A166493D210342F88A9279170548095FD9A5E64000F7ECC78AFBDFFD5
Malicious:	false
Preview:	........[...j.d<..k.s<..l.~<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..=..}..=.....=....#=....+=....3=....;=....B=....I=....P=....Q=....R=....}=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.... >....8>....N>....U>....X>....Y>....g>....r>....\|>.....>.....>.....>.....>.....>.....>....>..+..>..,..>../..?..0..?..1.P?..2.d?..3.l?..4..?..5..?..6..?..7..@..>..@..?.'@..N.8@..g.B@..i.E@..j.I@..k.P@..l.W@...Z]@...Z.@...Z.@...ZPA...ZXA...ZxA...Z.A...Z.A...Z.A...Z.B...Z.B...Z.C...Z.C...Z.C...Z+C...Z7C...ZkC...Z.C...Z>D...ZiD...ZnD.. Z.D..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.E..,Z6E..5Z?E..7ZXE..=Z]E..>ZnE..?ZyE..AZ.E..BZ.E..CZ.E..DZ.F..EZ.F..FZF..GZVF..HZ.F..IZ#G..JZ.G..KZ.G..LZ.G..MZ.G..PZ.H..QZ.H..RZ.I..SZ.I..TZ.I..VZ.I..WZXJ..XZ.J..YZ.J..ZZ.J..[Z.K..\Z+L..]Z.L..^Z4M.._Z.M..cZ.M..dZ.M..eZ.M..fZ.M..gZ.M..lZ;N..mZoN..nZ.N..oZ.N..pZ.O..qZLO..rZ.O..sZ.P..tZ_P..uZ.P..zZ7Q..{Z?Q..\|ZGQ..}ZKQ..~ZOQ...ZfQ...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...ZQR...ZbR

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	147321
Entropy (8bit):	5.78192019373809
Encrypted:	false
SSDEEP:	1536:Dmnjv2XktgKy+34AhBbFKEtINB46wVsg+jt+nF0rw4NPVI:620iPAhBbFKEtEaijt+FSw4NPVI
MD5:	833E8C4AA70351B6BE7BD403E4E9A0A7
SHA1:	46CCDBDEA35DEEC8EF13A5FC833776875FAD187B
SHA-256:	74422DB1A5F28522F9A8B31A3BEE9A6DF794B419BF723CB6A6C88E82EB72CEC0
SHA-512:	E8E709612A5EA81D2822E0025B7306F38571F2CEC2CA72AC5A8AB852A0E36A0F5BC7E00D0BAF7AC7BECC2C54DDA3A17C52EC1CD67CE12B14D91B6AE0B726D556
Malicious:	false
Preview:	..........Y.j..;..k..;..l..;..m..;..o..<..p..<..q..<..v.#<..w.0<..y.6<..z.E<..\|.K<..}.]<....e<....j<....r<....}<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....=....+=....L=....m=....o=....s=.....=.....=.....=.....=.....=.....=.....>.... >....#>....,>....5>....;>....D>....Q>....d>....j>....p>.....>..*..>..+..>..,..>../..>..0..>..1.%?..2.<?..3.K?..4.l?..5..?..6..?..7..@..>..@..?.(@..N.=@..g.J@..i.M@..j.Q@..k.V@..l.^@...Zc@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.B...ZIB...Z[B...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z!D...Z`D...Z'E...ZZE.. Z.E..!Z.E.."Z.E..#Z.E..$Z.E..%Z.F..&Z2F..,Z.F..5Z.F..7Z.F..=Z.F..>Z.F..?Z.F..AZ-G..BZhG..CZ.G..DZ.G..EZ.G..FZ.G..GZ.G..HZ.H..IZ.H..JZ.I..KZ.I..LZ.I..MZ.I..PZ.I..QZ.J..RZSK..SZdK..TZ.K..VZ.K..WZ.L..XZ.L..YZ.M..ZZ$M..[Z]M..\ZHN..]Z.N..^ZnO.._Z.O..aZ.O..cZ.O..dZ.P..eZ.P..fZ"P..gZ\P..lZ.P..mZ.P..nZhQ..oZ\|Q..pZ.Q..qZ.Q..rZ.R..sZ]R..tZ.R..uZ.S..zZ.S..\|Z.S..}Z.S..~Z.S...Z.S...Z.S...Z.T...Z.T...Z-T...Z0T...ZfT...Z.T...Z.T...Z&U...Z=U...ZgU...ZmU...Z.U...Z.U

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	283786
Entropy (8bit):	4.305068862178892
Encrypted:	false
SSDEEP:	3072:dtII+Ix4qhgrtZ+e4PzZELDCHEgGntw9e/u5RDu6h1TMfE7JQO5M2/k9fyvyAT:d2I+4gyEgGntwk+RDu6h1TM87JQO6Ayq
MD5:	5115CDE84B4C674DB412619B65433004
SHA1:	164F33E7E2E9F685A579DA492A6FC8806BEB6CBF
SHA-256:	891E092C6895E23BE986C3E6D39DCEA9B6B75F1448239C13FD406680E50407A7
SHA-512:	090A247898CB533325D2B289A6CBD8DB2A755EF0ABAB49D82F333E57B290C50B5996B81F15D8ADC30160B216EEBED3A1476AEC1627195E52189557C1D48B0216
Malicious:	false
Preview:	........G. .j.<<..k.K<..l.V<..n.^<..o.c<..p.p<..q.v<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....=.....=.....=.....=....!=....(=....)=....=.....=.....=....>....j>.....>.....>.....>.....>.....>....,?....`?.....?.....?.....@.....@.....@.....@....2@....V@....t@.....@.....@.....@.....@.....@.....A..*.RA..+.UA..,.sA../..A..0..A..1.UB..2.oB..3..B..4..B..5.)C..6..C..7..C..>.(D..?.;D..N..D..g..D..i..D..j..D..k..D..l..D...Z.D...Z.E...Z.E...Z+G...ZCG...Z.G...Z.G...Z)H...ZxH...Z.H...Z.K...Z.K...Z.K...Z.L...Z>L...ZeL...Z.L...Z7M...Z.N...Z.N...Z.O.. Z~O..!Z.O.."Z.O..#Z.O..$Z'P..%ZdP..&Z.P..,ZtQ..5Z.Q..7Z.Q..=Z.Q..>Z.R..?Z.R..AZ.R..BZ7S..CZhS..DZ.S..EZ.S..FZ.T..GZ.T..HZ.U..IZ.V..JZ.W..KZ.X..LZsX..MZ.X..PZ.Y..QZ.Z..RZ.\..SZ.\..TZ.]..VZ.]..WZ.^..XZ@`..YZ.`..ZZ.`..[Z#a..\Z(e..]Z.f..^Z.h.._Z.h..cZAi..dZ.i..eZ.i..fZ.i..gZ?j..lZ#k..mZ.k..nZ.l..oZ.l..pZ:m..qZ.m..rZ.n..sZ.o..tZvp..uZ.p..zZAr..{Z\r..\|Zwr..}Z.r..~Z.r...Z.r...ZDs...Z.s...Z.s...Z.s...Z.s...Z-t...Zkt...Z.t...Z.u...Z.u

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	123298
Entropy (8bit):	6.09977499725321
Encrypted:	false
SSDEEP:	3072:R56txdM7zbccIotd9AgWCYeHw0pFSCukprTrCNO/4KiWgx1A/xRAmxJT6rJ6TNGg:R56Te7nVti67oSw4B
MD5:	D6E2C18C9EABBA59B50D147D942125EA
SHA1:	0918879203C2050B4F9F449F5616E430897BA0B9
SHA-256:	F3581CEA2E5B022B121010FFC5D67F86F717E3A0C0402ABD81E24C87FD135B76
SHA-512:	F605F7B9893166778AF156F9EB76EAA1209E7432450899540CD462CE0FFA69CAF6F570B910CDD6D7BEF54354379E9892A658E711BAA93241DA33755C107DA859
Malicious:	false
Preview:	..........^.j..;..k..;..l..;..m..;..o..;..p..;..q..;..r..;..s..<..t..<..y..<..z.=<..\|.C<..}.U<....]<....b<....j<....u<....}<.....<.....<.....<.....<.....<.....<.....<.....<.....=.....=.....=...."=.....=....5=....K=....[=....h=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=....>..+..>..,.<>../.R>..0.^>..1..>..2..>..3..>..4..>..5..?..6.=?..7.S?..>.j?..?.{?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.@...Z.@...Z.@...Z.@...Z.@...Z&A...Z@A...Z/B...ZBB...ZKB...ZTB...ZhB...ZnB...Z.B...Z.B...Z6C...ZfC...ZlC.. Z.C..!Z.C.."Z.C..#Z.C..$Z.C..%Z.C..&Z.C..,ZFD..5ZLD..7ZcD..=ZiD..>Z.D..?Z.D..AZ.D..BZ.E..CZ#E..DZ0E..EZ6E..FZTE..GZ.E..HZ.F..IZ~F..JZ.F..KZ.G..LZ?G..MZLG..PZ\G..QZ.H..RZ.I..SZ.I..TZI..VZeI..WZ.I..XZ<J..YZIJ..ZZeJ..[Z.J..\Z.K..]Z+L..^Z.L.._Z.L..cZ&M..dZ3M..eZFM..fZSM..gZ.M..lZ.M..mZ.N..nZkN..oZ.N..pZ.N..qZ.N..rZ&O..sZkO..tZ.O..uZ.O..\|Z.P..}Z.P..~Z.P...Z.P...Z.P...Z.P...Z.P...Z.P...Z.P...Z.Q...Z7Q...Z\Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z.R...Z.R...Z7R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	134992
Entropy (8bit):	5.619012675950288
Encrypted:	false
SSDEEP:	1536:0YPKCj8j0t588FYhxBUMCUacC0YViX26sK5rmz3MWFmmVtM2ID6S2h5nYWSgAGiS:0YCo8emB1CUaW29bXJvM2ID6S2h5nJ
MD5:	2D4FCA437A7548893DC4B51FA5B33C33
SHA1:	C1493013D7D981EA9223716E415380992DE65C2F
SHA-256:	776DBA792DF7B444E1B720326312D8B8312CADE74A1372C49456D932B7C65769
SHA-512:	B6A55EE1DEFF48D717A3E9399AEF3C45EEEC810CC5B5709FA3E9F56850115A5B02E02B7959EC77A6797E68516EE9372BACD260E62AC0D55A8E4C1C27AF782B42
Malicious:	false
Preview:	........[...j.d<..k.s<..l.~<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..=..}..=.....=....#=....+=....3=....;=....B=....I=....P=....Q=....R=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>..../>....F>....M>....P>....Q>....[>....f>....m>....v>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.M?..2.^?..3.o?..4..?..5..?..6..@..7.)@..>.I@..?.R@..N.e@..g.s@..i.v@..j.z@..k..@..l..@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.A...Z.A...Z.B...Z(B...Z.D...Z.D...Z.D...Z.D...Z.D...Z.D...Z.E...ZHE...Z.E...Z.E...Z.F.. Z)F..!Z=F.."ZdF..#ZlF..$Z.F..%Z.F..&Z.F..,Z.F..5Z.F..7Z.G..=Z.G..>Z"G..?Z5G..AZ.G..BZ.G..CZ.G..DZ.G..EZ.G..FZ.G..GZ(H..HZ.H..IZ$I..JZ.I..KZ.I..LZ.J..MZ.J..PZDJ..QZ.J..RZ.K..SZ.K..TZ.K..VZ.K..WZeL..XZpM..YZ.M..ZZ.M..[Z.M..\Z.O..]Z"Q..^Z7R.._Z.R..aZ.R..cZ.R..dZ.R..eZ.R..fZ.R..gZ&S..lZ.S..mZ.S..nZ.T..oZ4T..pZKT..qZ.T..rZ.U..sZXU..tZ.U..uZ.U..zZ.V..\|Z.V..}Z.V..~Z.V...Z.V...Z.W...Z.W...Z.W...Z/W...Z2W...ZJW...ZqW...Z.W...Z.W...Z.W

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	133988
Entropy (8bit):	5.6200654048601475
Encrypted:	false
SSDEEP:	1536:cHZ2smMA3hkixkDXARcDq2GBrM9AdfeYUdoIvlR8zOHP4/SuAhaI12mE42QtaDuC:cZ/U3e2kDXAoq2Gi9AdUdoI38fASfZ1d
MD5:	264C6E20B3088CEB4DAE5773CEF0CB55
SHA1:	FB6FF83FF14DF008092BC3EE73BDA7491E8E090E
SHA-256:	A676A781C1A587EADF23E5C69BC52F2D352346A70BC53CA908450362535EEFDA
SHA-512:	01E949F92E1E8599C581929A601D39640ABAF1D907CE10102E591C3D490DD3874C679C75BB51308EAD55A3BD0C6DCD1B8D4B2DAF98CE1CF1C6BAB42946E8B1E8
Malicious:	false
Preview:	........h...j.~<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..=..y..=..z..=..\|..=..}.0=....8=....==....E=....M=....U=....\=....c=....j=....k=....l=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....$>....6>....O>....g>....n>....q>....r>....\|>.....>.....>.....>.....>.....>.....>.....>.....>..*..>..+..>..,..?../.5?..0.E?..1.~?..2..?..3..?..4..?..5..?..6..@..7.0@..>.D@..?.L@..N.\@..g.f@..i.i@..j.m@..k.r@..l.z@...Z.@...Z.@...Z.@...ZpA...ZwA...Z.A...Z.A...Z.A...Z.B...Z.B...Z.C...Z.D...Z.D...Z'D...Z:D...ZFD...ZnD...Z.D...Z0E...Z[E...ZcE.. Z.E..!Z.E.."Z.E..#Z.E..$Z.E..%Z.E..&Z.F..,ZPF..5Z\F..7ZmF..=ZvF..>Z.F..?Z.F..AZ.F..BZ.G..CZ#G..DZ8G..EZ>G..FZSG..GZxG..HZ.G..IZjH..JZ.H..KZ.I..LZ%I..MZ8I..PZSI..QZ.I..RZ.J..SZ.J..TZ.J..VZ.K..WZ.K..XZZL..YZaL..ZZrL..[Z.L..\Z.N..]Z.O..^ZSP.._Z.P..aZ.P..cZ.P..dZ.P..eZ.P..fZ.P..gZ.Q..lZhQ..mZ.Q..nZ.Q..oZ.R..pZ.R..qZPR..rZ.R..sZ.R..tZ<S..uZkS..zZ.S..{Z.T..\|Z.T..}Z.T..~Z.T...Z8T...ZNT...ZuT...ZvT...Z.T...Z.T...Z.T...Z.T...Z.U...ZBU

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	299653
Entropy (8bit):	4.326601399952947
Encrypted:	false
SSDEEP:	768:gKeL13FPMSlGptmGrTdeE+YBkbrQ4OUyWpdDwbRQuyU62LV3YRBS:gKeL11EGE+YBkPQ4OOdkbRTy237
MD5:	04B2540C25990A5E0A9B227DCCE6AE0D
SHA1:	4F8CCD154F54DFB083D4D1A3ED0994842C8AB13E
SHA-256:	556165B8B54C6E21BC66D12B3F5BE393136714467C427F7114F314D18AD3C661
SHA-512:	4CAB47E42E8F5D4A83851871F97F3E1360C993BA530DBB4B4B736350779784BD83189E1195D3480CE87298BB8F9B7F249FEFA7764D850E5B0002895609626785
Malicious:	false
Preview:	........E.".j.8<..k.G<..l.R<..n.Z<..o._<..p.l<..q.r<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....=.....=.....=.....=....$=....%=....&=.....=.....=.....>....Q>.....>.....>.....>.....>.....>.....?....J?.....?.....?.....?.....?.....?.....?.....@....;@....h@.....@.....@.....@.....@.....A....AA..*.qA..+.tA..,..A../..A..0..A..1..B..2..B..3..B..4..C..5.~C..6..D..7.ZD..>..D..?..D..N."E..g.DE..i.GE..j.KE..k.PE..l.dE...ZiE...Z.E...Z;F...Z&H...ZDH...Z.H...Z.H...Z.I...Z.I...Z.I...Z.K...Z.L...Z&L...ZGL...Z.L...Z.L...Z.L...ZiM...Z.N...Z\O...ZzO.. Z.O..!Z.P.."ZfP..#ZxP..$Z.P..%Z.Q..&Z:Q..,Z.Q..5Z.R..7Z.R..=ZRR..>Z.R..?Z.R..AZeS..BZ.S..CZ.S..DZ/T..EZVT..FZ.T..GZ.U..HZTV..IZrW..JZ.X..KZ.X..LZpY..MZ.Y..PZ.Y..QZ~[..RZ.]..SZ.]..TZ.^..VZ.^..WZ.`..XZ.a..YZYa..ZZ.a..[Z.a..\Z.d..]Z.e..^Z.f.._Z.g..aZ.g..cZ.g..dZ.h..eZ9h..fZqh..gZ.h..lZ.i..mZqj..nZ.k..oZ.k..pZ$l..qZ.l..rZ.m..sZPn..tZ3o..uZ.o..zZRq..\|Z\|q..}Z.q..~Z.q...Z.q...Z3r...Zmr...Znr...Z.r...Z.r...Z.s...Zns...Z.s...Ztt...Z.t

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	246236
Entropy (8bit):	4.377876126104495
Encrypted:	false
SSDEEP:	3072:6IS/vAuETAbbbMB6D/Wcq02HIUIuc7nCSZhV9yFlWSLQMD8jB3qvHY6XU6LDFs:QCpy
MD5:	F22C99FE6A838E333E8EE06A4D01296B
SHA1:	C3542EA8DD45A2B387DD02FA5687948F135E10F2
SHA-256:	B03A3042F907AED13253AE8083D08F5FAD59FF438D024B097276856E72526911
SHA-512:	882022C2CB985D85F96D52C9BCFEEB089D6FF30E66187CCF424EF622092B9D359A51BDEF1FB6AC3B9D3409AA79D37CA737BA7F3ED8B9CDAABFE04D90A7C8BC15
Malicious:	false
Preview:	........3.4.j..<..k.#<..l..<..n.6<..o.;<..p.H<..q.N<..r.]<..s.n<..t.w<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....=.....=.....=.....=.....=.....=.....=..../>....1>....5>....c>....y>.....>.....>.....>.....>...."?....)?....,?.....?....A?....P?....{?.....?.....?.....?.....?.....?.....@..*.9@..+.<@..,.Z@../..@..0..@..1..A..2.4A..3.MA..4..A..5..A..6./B..7.]B..>..B..?..B..N..B..g..C..i..C..j..C..k..C..l.#C...Z(C...Z.C...Z.C...Z3E...ZUE...Z.E...Z.E...Z=F...ZcF...Z0H...ZdH...ZmH...Z.H...Z.H...Z.H...Z.I...ZlI...ZiJ...Z.J...Z.J.. Z&K..!ZEK.."ZtK..#Z.K..$Z.K..%Z.K..&Z.L..,Z.L..5Z.L..7Z.L..=Z.L..>Z'M..?ZPM..AZ#N..BZsN..CZ.N..DZ.N..EZ.N..FZ<O..GZ.O..HZ.P..IZ.Q..JZ.R..KZ.R..LZ S..MZOS..PZ.S..QZ.T..RZ.V..SZ.V..TZ.W..VZ.W..WZ.X..XZ.Y..YZ%Z..ZZTZ..[Z.Z..\Z.\..]Z.]..^Z.^.._Zq_..aZ._..cZ._..dZ.`..eZ.`..fZF`..gZ.`..lZea..mZ.a..nZ.b..oZ.b..pZ?c..qZ.c..rZ.d..sZTe..tZ!f..uZ.f..zZ.g..{Z.h..\|Z#h..}Z2h..~Z>h...Z.h...Z.h...Z.i...Z.i...Z4i...Z7i...Z.i...Z.i...Z.i...Z.j...Z.j

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	114687
Entropy (8bit):	5.246382675678305
Encrypted:	false
SSDEEP:	1536:AQRHspdGCYixjxq+9cGnjBSaYOY9vSgAa6o+8uXpt:y7GCYOjx8GnjBStx6B8uXpt
MD5:	6CFADAA784E687E6DADBCD80E631BC9B
SHA1:	481ACB75F525055BF4E45ECABE0EADCB9C492106
SHA-256:	FB5E125DD5E1F21E8DF229D22CB3D1F9078BD79BBDDCA352899248F2A8B21B71
SHA-512:	0D7DA5A90FE9372BC704AB8CDC8CBFB14D323CAFDEF856987E2D9E34D980196C03985E25099F5D1BCB10C97F040F4766E2C3713718649BB3F43914A77F0DBB39
Malicious:	false
Preview:	........T...j.V<..k.e<..l.p<..n.x<..o.}<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....%=....-=....4=....;=....B=....C=....D=....n=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....2>....I>....P>....S>....T>....^>....i>....q>....v>....\|>.....>.....>.....>.....>....>..+..>..,..>../..>..0..>..1.)?..2.6?..3.A?..4.`?..5.s?..6..?..7..?..>..?..?..?..N..?..g..@..i..@..j..@..k..@..l..@...Z!@...ZB@...Z[@...Z.@...Z.@...Z.A...Z'A...ZcA...ZrA...ZOB...Z`B...ZgB...ZmB...Z~B...Z.B...Z.B...Z.B...ZGC...ZgC...ZlC.. Z.C..!Z.C.."Z.C..#Z.C..$Z.C..%Z.C..&Z.C..,Z)D..5Z<D..7ZMD..=ZSD..>Z^D..?ZhD..AZ.D..BZ.D..CZ.D..DZ.D..EZ.D..FZ.E..GZ4E..HZ.E..IZ.F..JZkF..KZ\|F..LZ.F..MZ.F..PZ.F..QZDG..RZ.G..SZ.H..TZ.H..VZ?H..WZ.H..XZ.I..YZ.I..ZZI..[ZJI..\ZKJ..]Z.J..^Z)K.._ZiK..aZ.K..cZ.K..dZ.K..eZ.K..fZ.K..gZ.K..lZ.L..mZ;L..nZ.L..oZ.L..pZ.L..qZ.L..rZFM..sZ.M..tZ.M..uZ.M..zZ.N..\|Z.N..}Z.N..~Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.O...Z-O...ZRO...Z.O...Z.O...Z.O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	113354
Entropy (8bit):	5.421961765781784
Encrypted:	false
SSDEEP:	1536:gh98CDQUBlHnHde4O9iXwDXqFQIm8VUvCATpdpLn:W+CDQWHn95WDXqFQIwCcpz
MD5:	B61E42F66D581B6A8929CDF5FB10662E
SHA1:	6F06FA9EE092FBCB61BBD668734FB3B92CFB549A
SHA-256:	1B17DCDE8FC7308D926FBE0FAA83DFC9FFE2EFC5715E9AFD557DDE839AD98B7E
SHA-512:	79B82346C3F133A6BA44148A8432AD4E08E2805187B759509CB386BC800FD20215592C07D953812C243F0B1D5E1354245F2CB42B2B3EB6C87280BCB4008DBE97
Malicious:	false
Preview:	........T...j.V<..k.e<..l.p<..n.x<..o.}<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....%=....-=....4=....;=....B=....C=....D=....k=....v=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>.....>.....>.... >....+>..../>....6>....A>....H>....L>....d>..*.o>..+.r>..,..>../..>..0..>..1..>..2..>..3..>..4..?..5.!?..6.X?..7.o?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z.@...Z.@...Z.@...Z.@...Z.@...Z.@...Z!A...Z/A...Z.A...Z.A...Z.A...Z.B...Z.B...Z$B...ZWB...ZxB...Z.C...Z:C...ZCC.. ZhC..!ZoC.."Z.C..#Z.C..$Z.C..%Z.C..&Z.C..,Z.C..5Z.D..7Z.D..=Z.D..>Z3D..?Z?D..AZ.D..BZ.D..CZ.D..DZ.D..EZ.D..FZ.D..GZ.E..HZ.E..IZ.E..JZIF..KZ\F..LZ.F..MZ.F..PZ.F..QZ.G..RZ.G..SZ.G..TZ.G..VZ.G..WZaH..XZ.H..YZ.H..ZZ.H..[Z.H..\Z.I..]Z[J..^Z.J.._Z.K..aZ,K..cZ2K..dZ:K..eZAK..fZMK..gZwK..lZ.K..mZ.K..nZ^L..oZ.L..pZ.L..qZ.L..rZ'M..sZkM..tZ.M..uZ.M..zZ.N..\|Z.N..}Z.N..~Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.N...Z.O...Z0O...ZNO...Z.O...Z.O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	117517
Entropy (8bit):	5.352011872054347
Encrypted:	false
SSDEEP:	3072:nq1YE5LjDjkJkS6/gHkIINe2AyTievOoWnV:nJ6/bY2KnV
MD5:	CF6B1CBFD669E9461553974BA37A475E
SHA1:	B33867E9BC7FD88CA98A76DC4BD756BCF18887AA
SHA-256:	9A83AD866AD7FD9D65ECBC1E95C276CFCE27E8257C76A16950FD14971E66B864
SHA-512:	E463029BB37F6BB3FF5CB6281F64291ADA1B785FA33137E7AEDFC7B5E409E99C75A91E7CF9B6C0933E970F70C14861190DE66FC5D68925B687A6F5DA02E21077
Malicious:	false
Preview:	........\...j.f<..k.u<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=.... =....%=....-=....5=....==....D=....K=....R=....S=....T=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....3>....G>....N>....Q>....R>...._>....l>....v>....}>.....>.....>.....>.....>.....>....>..+..>..,..>../..>..0..>..1.4?..2.@?..3.M?..4.h?..5..?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j. @..k.'@..l.-@...Z2@...ZZ@...Zu@...Z.A...Z.A...Z'A...Z;A...ZQA...Z.A...Z.A...ZxB...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.B...Z.C...Z.C...Z.C.. Z.C..!Z.C.."Z.D..#Z.D..$Z2D..%ZGD..&ZSD..,Z.D..5Z.D..7Z.D..=Z.D..>Z.D..?Z.D..AZ.D..BZ.E..CZ"E..DZ0E..EZ5E..FZKE..GZ\|E..HZ.E..IZFF..JZ.F..KZ.F..LZ.F..MZ.F..PZ.G..QZ.G..RZ?H..SZNH..TZ_H..VZ.H..WZ.H..XZ^I..YZoI..ZZzI..[Z.I..\Z.J..]Z1K..^Z.K.._Z.K..aZ.L..cZ.L..dZ"L..eZL..fZ9L..gZfL..lZ.L..mZ.L..nZRM..oZmM..pZ.M..qZ.M..rZ.N..sZON..tZ.N..uZ.N..zZTO..{Z^O..\|ZiO..}ZnO..~ZrO...Z.O...Z.O...Z.O...Z.O...Z.O...Z.O...Z.O...Z.P...Z-P...ZqP

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	128440
Entropy (8bit):	5.741481793310835
Encrypted:	false
SSDEEP:	1536:EWf15TjBmqu4RMa8oc/1QCmCwAezXpSOv4KNsNYziU3yvvLr:LBK1QC0Xp94NYziU3y3
MD5:	9CA27098CA3024B4976BB1F7A3D1452E
SHA1:	841200DFA7A6E2549B1EF5CCA0FF85F4E82E8E89
SHA-256:	5099789CD5697A8DC3D32AB2D57A37320BA6B0E03282280F2DF30CC5B1FD70DF
SHA-512:	3EB6235CFB8E7CCF3492CBD6C70AF8662490EB0F2A8691C290882750CEEA93DADA6191D7909C96300556CC7AC0845E92A334C62B8DD9126F47F49D74A625A467
Malicious:	false
Preview:	........_...j.l<..k.{<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=....&=....+=....3=....;=....C=....J=....Q=....X=....Y=....Z=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>....E>....L>....O>....P>....[>....g>....q>....x>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.E?..2.T?..3.]?..4.\|?..5..?..6..?..7..?..>..@..?..@..N..@..g.)@..i.,@..j.0@..k.5@..l.<@...ZA@...Zk@...Z.@...Z-A...Z5A...ZYA...ZkA...Z~A...Z.A...Z.A...ZXC...ZoC...ZvC...Z\|C...Z.C...Z.C...Z.C...Z.C...ZyD...Z.D...Z.D.. Z.D..!Z.D..#Z.E..$Z.E..%Z-E..&Z;E..,ZrE..5Z.E..7Z.E..=Z.E..>Z.E..?Z.E..AZ.F..BZ(F..CZ7F..DZIF..EZOF..FZhF..GZ.F..HZ.G..IZvG..JZ.G..KZ.H..LZEH..MZVH..PZlH..QZ.H..RZ.I..SZ.I..TZ.I..VZ.I..WZ_J..XZ.K..YZ.K..ZZ+K..[ZLK..\Z)M..]Z.N..^Z.N.._Z.O..aZ-O..cZ3O..dZBO..eZPO..fZ\O..gZ.O..lZ.O..mZ.O..nZKP..oZaP..pZrP..qZ.P..rZ.P..sZ@Q..tZ.Q..uZ.Q..zZ4R..{Z>R..\|ZHR..}ZPR..~ZSR...ZfR...Z.R...Z.R...Z.R...Z.R...Z.R...Z.R...Z.R...Z.S...ZLS...ZaS

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	122495
Entropy (8bit):	5.418193170758838
Encrypted:	false
SSDEEP:	1536:eU4WKuobJUUVFDjy/4NvWIQFv0Y0q4qc6x0xGUC/g5KM0mR:ewKuobJUg5e/OuIQmiXM0w
MD5:	BE36A854625B9F69EF6652CCD2472CD4
SHA1:	5387EF8856E6C59F1095495903CFA42D7D885227
SHA-256:	16E8994E7AA85133F9F038513385A20847DBC7356DF87AB08AE910AA48C40CE5
SHA-512:	1D9BF543BD03B212A9801E45AA8074B3B0EC40558865788E99551CF8BC07A5DED66CF4B6EE9F4612AA9AA9A8EE0EFCFD4C32BA451B543B1C46FD2B81CD7ACAC2
Malicious:	false
Preview:	........]...j.h<..k.w<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=...."=....'=..../=....7=....?=....F=....M=....T=....U=....V=....~=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....1>....G>....N>....Q>....R>....[>....d>....m>....s>....z>.....>.....>.....>.....>....>..+..>..,..>../..>..0..>..1.'?..2.:?..3.D?..4.h?..5..?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j..@..k..@..l.$@...Z)@...ZS@...Zp@...Z.@...Z.A...ZA...Z>A...ZQA...Z.A...Z.A...Z.B...Z.C...Z.C...Z.C...Z C...Z/C...ZHC...ZtC...Z.C...Z.D...Z.D.. Z2D..!Z?D.."ZZD..#ZcD..$Z.D..%Z.D..&Z.D..,Z.D..5Z.D..7Z.D..=Z.D..>Z.D..?Z.E..AZOE..BZqE..CZ~E..DZ.E..EZ.E..FZ.E..GZ.E..HZZF..IZ.F..JZBG..KZ\G..LZ.G..MZ.G..PZ.G..QZKH..RZ.I..SZ5I..TZII..VZuI..WZ.I..XZpJ..YZwJ..ZZ.J..[Z.J..\Z3L..]Z.L..^Z.M.._Z.M..aZ.N..cZ.N..dZ)N..eZ3N..fZBN..gZeN..lZ.N..mZ.N..nZ<O..oZNO..pZcO..qZ.O..rZ.O..sZIP..tZ.P..uZ.P..zZjQ..\|ZsQ..}ZwQ..~ZzQ...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z<R...Z.R...Z.R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	122697
Entropy (8bit):	5.406947004035026
Encrypted:	false
SSDEEP:	1536:+8PXVccivCxrfqsrX/+vrUrVQYdvxz2qKHftLmLaId619n:+8N2vHsrXWAVQ/LeaId619n
MD5:	952CAF6F6C1288FD315D3DE627B731FA
SHA1:	B454A44E5636F5492F3F8F98CC76F90386009511
SHA-256:	3D6310E285C22CA3B5C28681237BEF05D0D087009885BC05C7D17825E38D072F
SHA-512:	1AE66D65AC2ADAC1DCF08BBDBF8053CD1D0D0486826562767EDFBEA68952E4DF6DEF48A6047FD83BA97B1FAECB01F7EF978F932A33BC74DE3EF7D42254CB2154
Malicious:	false
Preview:	........b...j.r<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}.$=....,=....1=....9=....A=....I=....P=....W=....^=...._=....`=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.... >....7>....N>....U>....X>....Y>....b>....k>....t>....z>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.:?..2.M?..3.W?..4.{?..5..?..6..?..7..?..>..@..?..@..N.0@..g.<@..i.?@..j.C@..k.H@..l.O@...ZT@...Zy@...Z.@...Z#A...Z+A...ZPA...ZeA...Z\|A...Z.A...Z.A...Z.B...Z.B...Z.C...Z.C...Z.C...Z"C...ZLC...Z\|C...Z.D...Z+D...Z4D.. ZPD..!Z]D.."ZyD..#Z.D..$Z.D..%Z.D..&Z.D..,Z.D..5Z.E..7Z"E..=Z)E..>ZDE..?ZSE..AZ.E..BZ.E..CZ.E..DZ.E..EZ.E..FZ.F..GZEF..HZ.F..IZ$G..JZ.G..KZ.G..LZ.G..MZ.G..PZ.H..QZ.H..RZ.I..SZ.I..TZ.I..VZ.I..WZrJ..XZ.J..YZ.J..ZZ.K..[Z3K..\ZNL..]Z.L..^ZUM.._Z.M..aZ.M..cZ.M..dZ.M..eZ.M..fZ.M..gZ!N..lZxN..mZ.N..nZ.O..oZ9O..pZIO..qZ.O..rZ.O..sZ,P..tZ.P..uZ.P..zZPQ..{ZYQ..\|ZbQ..}ZfQ..~ZiQ...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.Q...Z.R...Z4R...Z.R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	125600
Entropy (8bit):	5.443492549882987
Encrypted:	false
SSDEEP:	1536:V3wMhjK82Ipb6k3qvImoMyVwd0pDv2Q2CpsPlJtWCXh68umVhwMs:RpGyqKpr2lPnXh68umLw5
MD5:	24B01A438A3AB9699D4CA97C081B5E82
SHA1:	0D0B082544D23425A74199FB0A6C11192F0BDF7D
SHA-256:	38290B1C9712296D82EA1681EF95544A1EEF4872289134B11E50AF735E6DEACA
SHA-512:	43199772312156F4633C4202499CDE8F808E5E632C2013EC1129ACEE01A3F184E86DF2616626173178EFE04B6F0773AD9A0E8B8CC6A735D23D68DCFE9DFD945B
Malicious:	false
Preview:	........J...j.B<..k.Q<..l.\<..n.d<..o.i<..p.v<..q.\|<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....=.....=.....=.....=.... =....'=.....=..../=....0=....k=....z=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>....->....4>....7>....8>....D>....P>....]>....e>....n>....~>.....>.....>.....>....>..+..>..,..>../..>..0..?..1./?..2.@?..3.K?..4.g?..5..?..6..?..7..?..>..?..?..?..N..@..g..@..i..@..j. @..k.%@..l.@...Z/@...Z]@...Zv@...Z.A...Z.A...Z1A...ZJA...ZbA...Z.A...Z.A...Z.B...Z.C...Z.C...Z.C...Z-C...Z4C...ZZC...Z.C...Z.D...Z?D...ZKD.. ZmD..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z.E..5Z-E..7ZAE..=ZJE..>ZYE..?ZiE..AZ.E..BZ.E..CZ.E..DZ.E..EZ.F..FZ.F..GZHF..HZ.F..IZ&G..JZ.G..KZ.G..LZ.G..MZ.G..PZ.G..QZrH..RZ.I..SZ/I..TZHI..VZtI..WZ.I..XZ~J..YZ.J..ZZ.J..[Z.J..\Z.L..]Z.L..^ZdM.._Z.M..cZ.M..dZ.M..eZ.M..fZ.M..gZ.N..lZdN..mZ.N..nZ.N..oZ.O..pZ.O..qZOO..rZ.O..sZ.O..tZEP..uZlP..zZ.P..\|Z.P..}Z.Q..~Z.Q...Z.Q...Z5Q...ZHQ...ZIQ...Z]Q...Z`Q...ZsQ...Z.Q...Z.Q...Z.Q...Z.R...Z"R

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	200122
Entropy (8bit):	4.905136726277032
Encrypted:	false
SSDEEP:	6144:0EaX+/KgHnOorP+SkdOrsL48dQgIvGRf9/3MJZyLv9c/Y4d0xKA:0EaX+/KgHnOorP+SkdOrsL48dQgIvGt9
MD5:	41C2B17F1765BA4CDF471CCEF0D908F7
SHA1:	DF0957D35390CD02DC6E02E4B5D908F86B91AA80
SHA-256:	FDD75FA21D874B6E79300111054A42E8B1EA0455B4303882BD11292EF2DD4575
SHA-512:	7EC360D1FA82640A7EC2364BA2C5CAFE31807D99E4B76B0F7F568BF781AE5078BAE2F9A67B8814F21612AA3681D22EDF30A7A73A201F49283FA90AF65471B8EA
Malicious:	false
Preview:	........,.;.j..<..k..<..l. <..n.(<..o.-<..p.:<..q.@<..r.O<..s.`<..t.i<..v.~<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<....L=....i=.....=.....=.....=.....=.....=.....=.....=.....>....!>....D>....b>.....>.....>.....>.....>.....>.....>.....>.....>.....>.....?.....?.....?....L?..*.]?..+.`?..,.~?../..?..0..?..1..@..2..@..3.3@..4.f@..5..@..6..A..7.1A..>._A..?.nA..N..A..g..A..i..A..j..A..k..A..l..A...Z.A...Z.B...Z@B...Z2C...ZDC...Z.C...Z.C...Z.C...Z7D...ZVD...ZJH...ZsH...Z.H...Z.H...Z.H...Z.H...Z.H...Z'I...Z.J...ZMJ...ZYJ.. Z.J..!Z.J.."Z.J..#Z.K..$Z.K..%ZNK..&ZdK..,Z.K..5Z.K..7Z.L..=Z.L..>Z<L..?ZYL..AZ.L..BZ.L..CZ.M..EZ+M..FZ\M..GZ.M..HZ.N..IZIO..JZ.O..KZ#P..LZZP..MZtP..PZ.P..QZ.Q..RZ.R..SZ.R..TZ.S..VZuS..WZQT..XZ.U..YZ.U..ZZ.U..[Z.V..\Z.Z..]Zi[..^Z.\.._Z1]..cZl]..dZ.]..eZ.]..fZ.]..gZ.^..lZ.^..mZ.^..nZt_..oZ._..pZ._..qZ.`..rZ.`..sZ.a..tZ.a..uZ.a..zZ.b..\|Z.b..}Z.b..~Z.b...Z.c...Z1c...Z`c...Zac...Z.c...Z.c...Z.c...Z.d...ZNd...Z.d...Z.d...Z.d...Z.e

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	130491
Entropy (8bit):	5.78141646423355
Encrypted:	false
SSDEEP:	1536:1kwlkWgaGF52MJ55Fvxr8YaQdOQb7SexkM+zBHCYpGd80G1gQPa:jlq1MKVxNaQotckM+zBHCYpj0G15Pa
MD5:	B35DAA0BD9627CA88B413A5AF7C6B4A4
SHA1:	D5EFDCBC7CA17DE29F3075F6434F31AB2E895826
SHA-256:	F47BC1F7F5AB64681D0B152E1A019DA60F0EF057EE8BF2CCEDE019DC4030C177
SHA-512:	48ABB6CA2290820DB2898B05820BB25E70FB1292C816EB0C8F17B3C5452DE9FFF7027D216D2BF413900F408F44ED4AC99151B28142A212C5CFF8DFE229E87B9B
Malicious:	false
Preview:	........d...j.v<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..=..z..=..\|..=..}.(=....0=....5=....==....E=....M=....T=....[=....b=....c=....d=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....%>....5>....H>....O>....R>....S>....a>....o>....w>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..>..0..?..1.7?..2.E?..3.U?..4.u?..5..?..6..?..7..?..>..?..?..@..N..@..g. @..i.#@..j.'@..k.0@..l.:@...Z?@...Zn@...Z.@...Z8A...Z@A...ZsA...Z.A...Z.A...Z.A...Z.A...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z2D...Z.D...Z.D...Z.D.. Z.E..!Z'E.."ZDE..#ZPE..$ZeE..%Z.E..&Z.E..,Z.E..5Z.E..7Z.E..=Z.E..>Z.F..?Z.F..AZdF..BZ.F..CZ.F..DZ.F..EZ.F..FZ.F..GZ.F..HZ\|G..IZ.G..JZLH..KZaH..LZ.H..MZ.H..PZ.H..QZDI..RZ.J..SZ.J..TZ)J..VZ`J..WZ.J..XZ.K..YZ.K..ZZ.K..[Z.K..\Z.M..]Z.N..^Z.O.._Z.O..aZ.O..cZ.O..dZ.P..eZ.P..fZ%P..gZRP..lZ.P..mZ.P..nZCQ..oZ\Q..pZjQ..qZ.Q..rZ.Q..sZ:R..tZ.R..uZ.R..zZOS..{ZXS..\|Z_S..}ZeS..~ZhS...Z{S...Z.S...Z.S...Z.S...Z.S...Z.S...Z.S...Z T...ZDT...Z.T...Z.T

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	124284
Entropy (8bit):	5.469010107144247
Encrypted:	false
SSDEEP:	1536:8gm/5D4zKn4qce+66W4xVsDn4Kph9VnJzIqTCORji/fzUrGsQqu:AWKn4qnRwxuU0VtIqTCO5i/fzbsQqu
MD5:	E015B6F5042BE2DC96A4E23DCF035502
SHA1:	7946509EED8DB1E4C1F3DA99FFE7155C86FDB4D6
SHA-256:	99536D1BC73EEC81D5BEBBFF641EA195544EE5E3A41BB17DDCEDF9CDE9B141D4
SHA-512:	B2A2EAAE93C506A053862BF1CDE02EEE53B3EA2E2FE4C964C51DBACB8B44DE820A779311CFE01458E2F08F88BCE1172E8C5E1E6D28CD3A355FF84BAA00023B8F
Malicious:	false
Preview:	........Q...j.P<..k._<..l.j<..n.r<..o.w<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=.....=....'=.....=....5=....<=....==....>=....h=....z=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....&>....)>....>....5>....=>....C>....H>....P>....[>....`>....f>.....>....>..+..>..,..>../..>..0..>..1..?..2..?..3.)?..4.E?..5.Z?..6..?..7..?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..@...Z.@...Z-@...ZW@...Z.@...Z.@...Z.A...Z3A...ZHA...Z}A...Z.A...ZwC...Z.C...Z.C...Z.C...Z.C...Z.C...Z.C...Z"D...Z.D...Z.D...Z.D.. Z.E..!Z)E..#ZME..$Z]E..%ZrE..&Z.E..,Z.E..5Z.E..7Z.E..=Z.E..>Z.E..?Z.F..AZLF..BZyF..CZ.F..DZ.F..EZ.F..FZ.F..GZ.F..HZVG..IZ.G..JZ3H..KZGH..LZmH..MZ\|H..PZ.H..QZ.H..RZ.I..SZ.I..TZ.I..VZ.I..WZoJ..XZRK..YZcK..ZZrK..[Z.K..\ZBN..]Z8O..^Z)P.._ZcP..aZ.P..cZ.P..dZ.P..eZ.P..fZ.P..gZ.P..lZ.Q..mZFQ..nZ.Q..oZ.Q..pZ.Q..qZ.Q..rZHR..sZ.R..tZ.R..uZ.R..zZxS..{Z~S..\|Z.S..}Z.S..~Z.S...Z.S...Z.S...Z.S...Z.S...Z.S...Z.S...Z.T...Z*T...ZZT...Z.T...Z.T

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	189457
Entropy (8bit):	4.831343547385849
Encrypted:	false
SSDEEP:	3072:1aL+prvr04qjOFDq9iHG3LFYJQaklw+f1AXFgDf37SjBn0yh9KlQc+NA3rGLqN6h:1aL+pLo+DlaazXGL37Sdn59bl/k/Z0
MD5:	AF7083F2A4BD95DCBE792EFADE352662
SHA1:	DC69AA831836016F6E66C6079931503D534A7862
SHA-256:	E3B80D9FDD420A05D66CC12E685AC94500106DD51A555BBFA2D085094F81E8DD
SHA-512:	342400BA94F6CD08152F96AA2B905184FAB429C38CEDB4BCB4AC0C503169A9ECD47AEF208B4D7FFAE08B0C0AFA7AA089347A20739379D05F3E4E111BE842B8C4
Malicious:	false
Preview:	........c...j.t<..k..<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}.&=.....=....3=....;=....C=....K=....R=....Y=....`=....a=....b=.....=.....=.....=....#>....X>....Z>....^>....l>.....>.....>.....>.....>.....?.....?....%?....(?....)?....3?....??....X?....f?....u?.....?.....?.....?.....?..*..?..+..?..,..@../.6@..0.?@..1..@..2..@..3..@..4..A..5.>A..6..A..7..A..>..A..?..B..N./B..g.EB..i.HB..j.LB..k.QB..l._B...ZdB...Z.B...Z.B...Z.D...Z.D...ZKD...ZiD...Z.D...Z.D...Z.E...Z.G...Z.G...Z.G...Z.H...Z&H...Z:H...ZgH...Z.H...Z.I...Z.J...Z J.. ZsJ..!Z.J.."Z.J..#Z.J..$Z.K..%ZTK..&ZkK..,Z.K..5Z.K..7Z.K..=Z.L..>Z:L..?ZWL..AZ.L..BZ#M..CZGM..DZnM..EZzM..FZ.M..GZ.M..HZ.N..IZKO..JZ.O..KZ.P..LZKP..MZdP..PZ.P..QZIQ..RZTR..SZmR..TZ.R..VZ.R..WZ.S..XZ.T..YZ.T..ZZ.U..[Z>U..\ZgX..]Z.Y..^Z.[.._Z{[..aZ.[..cZ.[..dZ.[..eZ.[..fZ.\..gZ=\..lZ.\..mZ.\..nZ.]..oZ.]..pZ.]..qZ,^..rZ.^..sZ:_..tZ._..uZ._..zZ.`..{Z.`..\|Z.`..}Z.`..~Z.`...Z a...ZFa...Zha...Zia...Z.a...Z.a...Z.a...Z.b...ZPb...Z.b

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	113699
Entropy (8bit):	5.505518016532448
Encrypted:	false
SSDEEP:	3072:3ax4VhU89KU6VWZtgKqrAuxHcShUpDm2jb1+r+D:3ax4Vd97bh
MD5:	D59DB925BD683480F4E3B2F4EB74C3BD
SHA1:	75B40770850787CE9DBDDF92725A5719F85C2AB0
SHA-256:	D60D3D4B8FD284A2457868FD06961BB79F3DC91B8C4505182C5E9778419FE849
SHA-512:	7D6B41569C2432535C0D55021EA9D78A1020F32D9D09A0624A90EBF76DC6904B04DF9DC86837161E0DB453A68B452FF829E0F8DF29E79869AF8B58314FE79ED3
Malicious:	false
Preview:	........P...j.N<..k.]<..l.h<..n.p<..o.u<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=.....=....%=....,=....3=....:=....;=....<=....f=....w=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>.....>.....>.....>....%>....0>....6>....>>....I>....U>....\>....k>...s>..+.v>..,..>../..>..0..>..1..>..2..>..3..>..4."?..5.7?..6.o?..7..?..>..?..?..?..N..?..g..?..i..?..j..?..k..?..l..?...Z.?...Z.?...Z"@...Z.@...Z.@...Z.@...Z.@...Z.A...ZA...ZAA...Z.B...Z$B...Z)B...Z3B...ZIB...ZWB...Z.B...Z.B...Z6C...ZaC...ZjC.. Z.C..!Z.C.."Z.C..#Z.C..$Z.C..%Z.C..&Z.C..,Z"D..5Z*D..7Z<D..=ZAD..>ZVD..?ZbD..AZ.D..BZ.D..CZ.D..DZ.D..EZ.D..FZ.E..GZ=E..HZ.E..IZ.F..JZrF..KZ.F..LZ.F..MZ.F..PZ.F..QZ[G..RZ.H..SZ.H..TZ+H..VZWH..WZ.H..XZ'I..YZ0I..ZZ=I..[Z_I..\ZHJ..]Z.J..^ZLK.._Z.K..aZ.K..cZ.K..dZ.K..eZ.K..fZ.K..gZ.K..lZBL..mZlL..nZ.L..oZ.L..pZ.L..qZ.M..rZ^M..sZ.M..tZ.M..uZ.N..zZ.N..{Z.N..\|Z.N..}Z.N..~Z.N...Z.N...Z.N...Z.N...Z.N...Z.O...Z.O...Z!O...ZTO...Z\|O...Z.O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	117451
Entropy (8bit):	5.335888214632848
Encrypted:	false
SSDEEP:	3072:IkZ8kRBeYLIdC9gDifpvjoXiPXptVPGuLey+uqHw2L:LWkr9gDiiX0wy+uqHw2L
MD5:	99E385EBC1EF8D3DADDB3A171FA79EDF
SHA1:	3164804DFE9D9B5E891ABAFE92E5BA67D2B5D4D1
SHA-256:	8EC45AC391A085D531FB21815086C2DA4841AA016653CB4F8484CFC2615D6C01
SHA-512:	797C105FECEF1E15870AA101E3FA1835D5A467A9059C03B3636C54934D1DE263AB7F23599E21D9787CB3849C7CB7D29F5BDD8AE9AD10FDA8015C1392462E94C0
Malicious:	false
Preview:	........P...j.N<..k.]<..l.h<..n.p<..o.u<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=.....=....%=....,=....3=....:=....;=....<=....`=....r=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....+>....2>....5>....6>....=>....B>....I>....N>....U>....a>....k>....p>.....>..*..>..+..>..,..>../..>..0..>..1..?..2.1?..3.;?..4.Q?..5.n?..6..?..7..?..>..?..?..?..N..?..g..@..i..@..j..@..k..@..l..@...Z.@...ZU@...Z{@...Z.A...Z#A...ZDA...ZVA...Z.A...Z.A...Z.B...Z.B...Z.B...Z.C...Z.C...Z'C...ZBC...ZvC...Z.C...Z.D...Z%D.. ZPD..!ZbD.."Z.D..#Z.D..$Z.D..%Z.D..&Z.D..,Z#E..5Z)E..7Z>E..=ZEE..>Z^E..?ZjE..AZ.E..BZ.E..CZ.F..DZ.F..EZ.F..FZ0F..GZaF..HZ.F..IZ9G..JZ.G..KZ.G..LZ.G..MZ.H..PZ,H..QZ.H..RZ.I..SZ.I..TZ.I..VZ.I..WZBJ..XZ.J..YZ.J..ZZ.J..[Z.J..\Z.L..]Z.L..^Z.L.._Z?M..aZ[M..cZaM..dZmM..eZ}M..fZ.M..gZ.M..lZ.M..mZ.N..nZ.N..oZ.N..pZ.N..qZ.N..rZ;O..sZ.O..tZ.O..uZ.O..zZ.P..\|Z.P..}Z.P..~Z.P...Z.P...Z.P...Z.P...Z.P...Z.P...Z.P...Z.Q...Z;Q...Z[Q...Z.Q...Z.Q...Z.Q

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	297573
Entropy (8bit):	4.119069899061228
Encrypted:	false
SSDEEP:	1536:BWOQC6V1UqEiKamQwfw+zuIRiE2k4ca6QVW640akEJoh1oQXP2FtR8++EG5aIAuK:BWF61NtRD
MD5:	832C52BD8D4BE5BE63C58BFF827A7358
SHA1:	BFDC7B27B78C4D0C0159EB88983024B4E2248E52
SHA-256:	B262C9DF040F934BE186DF5F32DD872F7360EBC51F3F5DCBAB11AB299C8AE298
SHA-512:	921A122D61F1A590657A23BAC939E921D1B6F9E83345FF2AC9BB6787B3D89AA39ACA067BE3FC6BFC9A8F62921D7D362404E5B41720E65B7E2E0F1F98A5DE612B
Malicious:	false
Preview:	........;.,.j.$<..k.3<..l.><..n.F<..o.K<..p.X<..q.^<..r.m<..s.~<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....<.....=.....=.....=.....=.....=.....=.....=.....>....H>.....>.....>.....>.....>.....>.....?....K?.....?.....?.....?.....?.....@.....@.... @....>@....S@...._@....r@.....@.....@.....@....9A..*.]A..+.`A..,.~A../..A..0..A..1.dB..2..B..3..B..4..C..5..C..6.1D..7.tD..>..D..?..D..N..E..g.0E..i.3E..j.7E..k.<E..l.JE...ZOE...Z.E...Z.F...Z.G...Z.G...Z@H...Z.H...Z.H...Z.I...Z.I...Z.L...Z.L...Z.L...Z.L...Z.M...Z/M...Z.M...Z.N...ZfO...Z.O...Z.O.. ZEP..!ZdP.."Z.P..#Z.P..$Z.P..%Z.Q..&Z[Q..,Z.Q..5Z.R..7Z9R..=ZER..>ZzR..?Z.R..AZmS..BZ.S..CZ.T..DZ3T..EZNT..FZ.T..GZ:U..HZ.V..IZ.W..JZ.Y..KZ[Y..LZ.Y..MZ-Z..PZzZ..QZ.[..RZ.^..SZ&^..TZl^..VZ._..WZp`..XZra..YZ.a..ZZ#b..[Z.b..\Z+e..]Z\f..^Zjg.._Zjh..aZ.h..cZ.h..dZ.i..eZ%i..fZPi..gZ.i..lZ.j..mZ.k..nZ.k..oZ/l..pZ.l..qZ&m..rZLn..sZ!o..tZ.o..uZup..zZ.r..{Z?r..\|ZTr..}Zcr..~Zrr...Z.r...Z.r...Z2s...Z3s...Zas...Zds...Z.s...Z1t...Z.t...Z.u

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276886
Entropy (8bit):	4.338969449111629
Encrypted:	false
SSDEEP:	6144:a3pxhAxjTaJAu+HbDGOs/gOipfJilvqdWuSwrQ7wdi45eRNw3LtM:OpxhAxjTaJAu+HbDGOs/gOipfJilvqde
MD5:	DEEF5B328099F4AB2B4028E53D788049
SHA1:	9FA13644B10E90BB2EAA838EB5BEA3D884147208
SHA-256:	2D27A4DAFE3BDBE89D255A5D1594503BC39DF22D6CDEE0F051DD10B6E176A053
SHA-512:	66985B079D392E7968478A23D5D11409714739E45DA905088B0B041AA3F5A1C37518E6BB00251C0482763BD5709C3C58FE48CEE5D74FAB53D4DBA744A2B46934
Malicious:	false
Preview:	........Q...j.P<..k._<..l.j<..n.r<..o.w<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=.....=....'=.....=....5=....<=....==....>=.....=.....=....)>....f>.....>.....>.....>.....>.....?....5?....W?....y?.....?.....?.....?.....?.....?.....@....<@....c@....{@.....@.....@.....@.....@....(A..*.OA..+.RA..,.pA../..A..0..A..1.\B..2.yB..3..B..4..B..5.;C..6..C..7..C..>.LD..?._D..N..D..g..D..i..D..j..D..k..D..l..D...Z.D...ZYE...Z.E...ZfG...Z.G...Z.G...Z.H...ZXH...Z.H...Z3I...Z.K...Z-K...Z9K...ZQK...Z.K...Z.K...Z.L...ZtL...Z.M...Z2N...ZMN.. Z.N..!Z.N.."Z_O..#Z}O..$Z.O..%Z.P..&Z2P..,Z.P..5Z.Q..7ZJQ..=ZiQ..>Z.Q..?Z.Q..AZ.R..BZ.R..CZ-S..DZpS..EZ.S..FZ.S..GZ?T..HZfU..IZrV..JZ.W..KZ.W..LZ.X..MZJX..PZ.X..QZ\Z..RZ]\..SZt\..TZ.\..VZE]..WZ.^..XZx_..YZ._..ZZ._..[ZM`..\Z.b..]Ztc..^ZRd.._Z$e..aZ.e..cZ.e..dZ.e..eZ.e..fZ"f..gZ.f..lZ_g..mZ.g..nZ.h..oZ0i..pZwi..qZ.i..rZ.j..sZ.k..tZOl..uZ.l..zZ.m..{Z.m..\|Z.n..}Z.n..~Z5n...Z.n...Z.n...Z.o...Z.o...Zao...Zdo...Z.o...Z.p...Zep...Z.q

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	232809
Entropy (8bit):	4.399076928349968
Encrypted:	false
SSDEEP:	6144:ZUCDnCJFkcSCkIO+CS/HIqXCh+OEzZK8QyYohw1p7GgNDM5a2FvZbhi8ltemQax:2CDnsFkcSCkIO+CS/HIqXCh+OEzZK8Q+
MD5:	43EDD25F67CE6E6CEA5373009FF0A1F8
SHA1:	ED72CA6620CF23837E1334BE50CCF616806BC5A2
SHA-256:	287897CF3DF2DB1CF59B872E6575BA8DFCAA0C1F68C17A9C91DA6C4490ADB8B0
SHA-512:	7160A72BD2E6B0FFA71E5D279995CC8BE24A87CD9386EB29AB0EEE79B8E607F5D824A11B6B4E3EF4C0F851A9D485A9642CB6ADAA65C07933DCA6E6F2C0052FC7
Malicious:	false
Preview:	..........O.j..;..k..;..l..;..o..;..p..<..q..<..r..<..s..<..t.7<..v.L<..w.Y<..y._<..z.n<..\|.t<..}..<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....=....A=....k=.....=.....>.....>.....>.....>....4>....g>.....>.....>.....>.....>.....>.....>.....?....,?....>?....G?....Z?.....?.....?.....?.....?....?..+..?..,..@../.7@..0.J@..1..@..2..@..3..A..4.PA..5..A..6.#B..7.DB..>.}B..?..B..N..B..g..B..i..B..j..B..k..B..l..C...Z.C...ZgC...Z.C...Z.D...Z.D...Z.E...ZBE...Z.E...Z.E...Z.G...Z.H...Z$H...Z<H...Z]H...Z{H...Z.H...Z5I...Z;J...ZwJ...Z.J.. Z.J..!Z.J.."Z+K..#Z:K..$Z^K..%Z.K..&Z.K..,ZTL..5ZpL..7Z.L..=Z.L..>Z.M..?Z.M..AZ.M..BZ.N..CZ3N..DZTN..EZoN..FZ.N..GZ.N..HZ.O..IZ.Q..JZ=R..KZgR..LZ.R..MZ.R..PZ.S..QZPT..RZ.U..SZ.V..TZ@V..VZ.V..WZ.W..XZFX..YZkX..ZZ.X..[Z.X..\Z\[..]ZZ\..^Z].._Z.]..aZ.]..cZ.^..dZ.^..eZ8^..fZS^..gZ.^..lZ#_..mZt_..nZb`..oZ.`..pZ.`..qZ.`..rZ.a..sZeb..tZ.c..uZVc..zZud..\|Z.d..}Z.d..~Z.d...Z.d...Z#e...ZDe...ZEe...Zce...Zfe...Z.e...Z.e...Z.e...Zmf...Z.f...Z.f...Z.f

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	120054
Entropy (8bit):	5.610774817178393
Encrypted:	false
SSDEEP:	3072:B+bwkMiMrAyvDsPnnNtOLlh74OfkiO8ru0j1914j4UDhJaaEiWwi1PLC2Ba5Y8GO:B+s5AVOUGaEvwiBFCH
MD5:	40491896AD21543F339467186C5EFB40
SHA1:	695DDE7CC35056DCBF0A533AFF8299D4C6B61BD8
SHA-256:	43E99E132ACABA88971B81A43531845DC7FC3A1E0794C3373DE7D9A50A5655AA
SHA-512:	18D5EE9914849462E0B1BAFD1CA216B29D0795E282AE0BDB354B15CAF5C18F37F44FBD6F626B2CBB095E3398A6496DE72E5B0D15621433979B5A589E34FAC818
Malicious:	false
Preview:	........^...j.j<..k.y<..l..<..n..<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..=..\|..=..}..=....$=....)=....1=....9=....A=....H=....O=....V=....W=....X=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....'>....9>....P>....i>....p>....s>....t>....}>.....>.....>.....>.....>.....>.....>.....>.....>..*..>..+..>..,..>../..?..0..?..1.H?..2.U?..3.c?..4.y?..5..?..6..?..7..?..>..@..?."@..N.0@..g.;@..i.>@..j.B@..k.G@..l.M@...ZV@...Z.@...Z.@...ZTA...Z]A...Z{A...Z.A...Z.A...Z.A...Z.A...Z.B...Z.B...Z.C...Z.C...Z)C...Z0C...Z]C...Z.C...Z5D...Z]D...ZiD.. Z.D..!Z.D.."Z.D..#Z.D..$Z.D..%Z.D..&Z.E..,ZJE..5Z_E..7ZlE..=ZrE..>Z.E..?Z.E..AZ.E..BZ.E..CZ.F..DZ.F..EZ"F..FZ5F..GZWF..HZ.F..JZJG..KZ]G..LZ.G..MZ.G..PZ.G..QZ?H..RZ.H..SZ.I..TZ$I..VZdI..WZ.I..XZ<J..YZQJ..ZZcJ..[Z.J..\Z.K..]Z)L..^Z.L.._Z.L..aZ.L..cZ.L..dZ.L..eZ.M..fZ.M..gZ=M..lZ.M..mZ.M..nZ.N..oZ2N..pZKN..qZ.N..rZ.N..sZ)O..tZ\|O..uZ.O..zZ,P..{Z2P..\|Z:P..}Z<P..~Z@P...ZTP...ZiP...Z.P...Z.P...Z.P...Z.P...Z.P...Z.P...Z.Q...ZWQ...ZnQ

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	202783
Entropy (8bit):	4.940904864453995
Encrypted:	false
SSDEEP:	3072:fZLrHFB3IjYVzDCjqCZyYL3FdULNiXEMQOCqWiqrEb4UHLHh:fZfHFB3IjYB6fULNiXEoCqWiqKB
MD5:	F7CB65C30ED422DE5AA691413168A994
SHA1:	C14B44231F057BDA8EAC8D312EAE001F8C34D1CE
SHA-256:	FC375516F856DBF8A6000FE54467DC6EA6F4D5BD3CA8DDB93274C41FB869F797
SHA-512:	BC8D852BAF5B8DE7CCFDCDAC05DF7BEAA35B72B027D8B1915A1746BAC7363473BC8A70986A4FB5353D10D0E8804263916FBFD8C2932465949878D20ED1DBB8E8
Malicious:	false
Preview:	........U...j.X<..k.g<..l.r<..n.z<..o..<..p..<..q..<..r..<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..=.....=.....=.....=....'=..../=....6=....==....D=....E=....F=.....=.....=.....=.....>....N>....P>....T>....f>....}>.....>.....>.....>.....>.....?....&?....)?....?....:?....L?....^?....l?.....?.....?.....?.....?.....?....?..+..?..,..@../.W@..0.i@..1..@..2..@..3..A..4.=A..5.lA..6..A..7..A..>..B..?.#B..N.DB..g.PB..i.SB..j.WB..k.^B..l.jB...ZoB...Z.B...Z.B...Z)D...Z;D...Z.D...Z.D...Z.D...Z;E...ZXE...Z.H...Z.H...Z.H...Z.I...Z*I...ZBI...ZfI...Z.I...Z.J...Z.K...Z.K.. ZbK..!Z}K.."Z.K..#Z.K..$Z.K..%Z.K..&Z.L..,ZxL..5Z.L..7Z.L..=Z.L..>Z.L..?Z.L..AZtM..BZ.M..CZ.M..DZ.M..EZ.N..GZ=N..HZ.N..IZ.O..JZaP..KZ.P..LZ.P..MZ.Q..PZHQ..QZ#R..RZbS..SZ\|S..TZ.S..VZ.S..WZ.T..XZnV..YZ{V..ZZ.V..[Z.V..\Z.Z..]Z.\..^Zu^.._Z.^..aZ.^..cZ._..dZ1_..eZJ_..fZg_..gZ._..lZ1`..mZt`..nZ.a..oZ?a..pZka..qZ.a..rZob..sZ.b..tZbc..uZ.c..zZ.d..\|Z.d..}Z.d..~Z.d...Z.e...Z:e...Zee...Zfe...Z.e...Z.e...Z.e...Z.e...Z-f...Z.f...Z.f...Z.g

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	143687
Entropy (8bit):	5.77363636185866
Encrypted:	false
SSDEEP:	3072:xcMRcddKMPni2Piz+sjoOa29C+UVUcEtya1bHNgqoziL8KqW8LTtdLpFeSBhvOg:xcsyr8Fs+UWPbtYzigK8T
MD5:	69C8796439192577F48BD249175AAF37
SHA1:	97C52088CA69DADA593DB0E42B2135D264646454
SHA-256:	D7FDB53592DE803A5FBCD8561C4918F1562F92FC8A3FD0039A2A1A7B76A8ECC2
SHA-512:	65EB7CB15291474EC7F9354775E59BCF334C90DDF3498EBD184E4C47118308421B2405BFA679E4B3A70ED1790E167C109FC2C72E89C3E31B5378CAE975424144
Malicious:	false
Preview:	........A.&.j.0<..k.?<..l.J<..n.R<..o.W<..p.d<..q.j<..r.y<..s..<..t..<..v..<..w..<..y..<..z..<..\|..<..}..<.....<.....<.....<.....<.....=.....=.....=.....=.....=.....=....A=....R=....c=.....=.....=.....=.....=.....=.....=.....=.....=.....>.....>....3>....:>....=>....>>....G>....P>....\>....b>....l>....~>.....>.....>.....>....>..+..>..,..>../..>..0..?..1.??..2.L?..3.W?..4.s?..5..?..6..?..7..?..>..@..?..@..N.8@..g.>@..i.A@..j.E@..k.J@..l.S@...ZX@...Z.@...Z.@...ZtA...Z}A...Z.A...Z.A...Z.B...Z#B...ZOC...ZdC...ZtC...Z.C...Z.C...Z.C...Z.C...Z%D...Z.D...Z.E...Z.E.. ZUE..!ZqE.."Z.E..#Z.E..$Z.E..%Z.E..&Z.E..,ZTF..5ZeF..7Z}F..=Z.F..>Z.F..?Z.F..AZ.F..BZ;G..CZJG..DZZG..EZ^G..FZuG..GZ.G..HZ:H..IZ.H..JZHI..KZXI..LZ.I..MZ.I..PZ.I..QZdJ..RZTK..SZrK..TZ.K..VZ.K..WZ@L..XZ.L..YZ.L..ZZ.L..[Z.L..\ZN..]Z.N..^Z<O.._Z.O..aZ.O..cZ.O..dZ.O..eZ.O..fZ.O..gZ.P..lZWP..mZ.P..nZ.P..oZ.Q..pZ'Q..qZNQ..rZ.Q..sZ=R..tZ.R..uZ.R..zZ.S..{Z.S..\|Z.S..}Z.S..~Z.S...Z.S...Z.T...Z'T...Z(T...Z:T...Z=T...ZoT...Z.T...Z.T...Z.U...Z+U

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	104240
Entropy (8bit):	6.665633251608711
Encrypted:	false
SSDEEP:	1536:CA2TixLkUB92k1VjicViixWnUnkg9QoxllnS:32tU/2k1Vji2iiAxID3lnS
MD5:	098D656A4F4BD8240BED10E7678186C7
SHA1:	0C19AB62B4262F1B51558E8AAA79E7741F73393A
SHA-256:	A55F568AD3A8854CEC25699484F55024501C8A0967738BA694E073151E5981C7
SHA-512:	084538CE774233CA6D4393BB42239B0B85E11BD73DD19BA47E55796CA19848941B037510C0FCA4AC08B4B2E0CCBC9B4AE72EF88A3E841738DD211961DC53C1E2
Malicious:	false
Preview:	..........Q.j..;..k..;..l..;..m..;..o..;..p..<..q..<..r..<..s.)<..t.2<..v.G<..w.T<..\|.Z<..}.l<....t<....\|<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....=...."=....$=....(=.....=....:=....F=....R=....d=....x=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=..*..=..+..=..,.#>../.8>..0.M>..1.q>..2..>..3..>..4..>..5..>..6..>..7..?..>.$?..?.4?..N.L?..g.Y?..i.\?..j.`?..k.e?..l.n?...Zs?...Z.?...Z.?...Z.@...Z$@...Z?@...ZQ@...Z.@...Z.@...ZdA...ZvA...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...ZPB...ZqB...ZzB.. Z.B..!Z.B.."Z.B..#Z.B..$Z.B..%Z.B..&Z.C..,ZCC..5ZUC..7ZgC..=ZmC..>Z\|C..?Z.C..AZ.C..BZ.D..CZ.D..DZ.D..EZ"D..FZ1D..GZXD..HZ.D..IZRE..JZ.E..KZ.E..LZ.F..MZ.F..PZ.F..QZ.F..RZcG..SZtG..TZ.G..VZ.G..WZ.H..XZ.H..YZ.H..ZZ.H..[Z.H..\Z.I..]Z.J..^ZXJ.._Z.J..aZ.J..cZ.J..dZ.J..eZ.J..fZ.J..gZ.K..lZLK..mZjK..nZ.K..oZ.K..pZ.K..qZ:L..rZ.L..sZ.L..tZ5M..uZfM..zZ.N..{Z.N..\|Z.N..}Z.N..~Z.N...Z1N...ZIN...Z^N...Z_N...ZnN...ZqN...Z.N...Z.N...Z.N...Z1O...ZEO...ZTO...Z`O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	103464
Entropy (8bit):	6.6658169055334096
Encrypted:	false
SSDEEP:	1536:EflsavakoRv9hdmDMOoW3mxc3si5nddeP2RhxS/8xVyiKYBdbr4F9O5/No4V3XiA:EflsadoLhdmjoondOI/N/9XiPI5AciTS
MD5:	029FA66683685096FD55192345222D03
SHA1:	C49FD292595555E99E108B88D0B43F68A0FA6564
SHA-256:	BD4F963A6315F4F9670B1D9AAB65BA314DDDDCD4D201C931190B16A3EA2B4436
SHA-512:	7070C00208976A4A1D10A3E88214681A6BBB4900573B33814C56702F828C0DB8B9B3629BF145F0EEDB81E8D6B2FAD2E4FCD09C43F9D20DC571D34A56446102EA
Malicious:	false
Preview:	..........S.j..;..k..;..l..;..n..;..o..;..p..<..q..<..r..<..s.+<..t.4<..v.I<..w.V<..y.\<..z.k<..\|.q<..}..<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....<.....=.....=...."=....&=....=....0=....9=....E=....W=....i=....}=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=.....=....>..+..>..,.4>../.I>..0.R>..1.v>..2..>..3..>..4..>..5..>..6..?..7..?..>.1?..?.;?..N.P?..g.]?..i.`?..j.d?..k.k?..l.s?...Zx?...Z.?...Z.?...ZD@...ZJ@...Z.@...Z.@...Z.@...Z.@...Z.@...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z.A...Z#B...Z.B...Z.B...Z.B.. Z.B..!Z.B.."Z.C..#Z.C..$Z'C..%ZEC..&ZWC..,Z.C..5Z.C..7Z.C..=Z.C..>Z.C..?Z.C..AZ.D..BZ]D..CZlD..DZxD..EZ~D..FZ.D..GZ.D..HZ4E..IZ.E..JZ.F..KZ.F..LZZF..MZfF..PZuF..QZ.F..RZ.G..SZ.G..TZ.G..VZ.G..WZWH..XZ.H..YZ.H..ZZ.H..[Z.H..\Z.I..]Z5J..^Z.J.._Z.J..aZ.J..cZ.J..dZ.J..eZ.J..fZ.J..gZ2K..lZtK..mZ.K..nZ.K..oZ.L..pZ.L..qZHL..rZ.L..sZ.L..tZ1M..uZ[M..zZ.M..{Z.M..\|Z.M..}Z.M..~Z.M...Z.N...Z5N...ZMN...ZNN...Z]N...Z`N...ZxN...Z.N...Z.N...Z.O...Z.O...Z)O

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources.pak

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	5066579
Entropy (8bit):	7.995777446344364
Encrypted:	true
SSDEEP:	98304:CjdQhQKtSikwpoyS1hX1F8r03pPMOh1SKurwr1QlMb+pYiuRH1GddivoE:odQaKtSi5poyS3A4MOhEKukrqqbaYDIw
MD5:	D1EABFE170135E6A704A9F09A9F04985
SHA1:	6C5287378FF373FE27DDB8CF6BF641C1C862AF3B
SHA-256:	91EFACF94428E702772779E5EBC122B25A1D12C64A3ED20BC0B5B396503BA308
SHA-512:	FA3FEC856DA70A2BDF6A211A4BF1D6D0114F925842D9D185570DEFE25F8F33216823E2473EFEFA5982859FFD783FCED912B086300B298201ABAA12711FE0F782
Malicious:	false
Preview:	............f.....h..&....'&....,&....f)...../...../...../.....0...0.0...0.8...00;...0.L...0.U...0.]...0E`...0.f...0.i...0mk...0.l...0[m...0_n...0.p...0Eu...0.y...0.....0.....0.....0.....0....0.....0....0....0H....0.....0:....0.....0.....0.....0)....0.....0t....0-....1.....1.....1.....1.....1+ ...1r4..(7{7..-7.B...7.C../7.F..07.K..17SU..27.V..37.Y..47km..57?r..67Z...77....87....97....:7H...;7...<7...=7'...>7....?7....@7....A7....B7....C7#...D7....E7&...F7....G7....H7....h7....i7....j7....k7w...l77...m7....n7....o7....p7;-..q7.8..r7.f..s7.m..t7{...u7....v7....w7P...x7...y72...z7....{7....\|7....}7a...~7....7.....7....7.....7....7.....7.....7.....7Q....:.....:p....:.....:.....:v....:1....;#....;.....;r....;.....;.....;.....;.....;.....;~....;.....;.....;.+...;.2...;.f...;.k...;>s...;.\|...;S~...;.....;}....;q....;.....;t....;3...0Hu...1H6...2H$$..3HK%..4H>)..5H_<..6H.D..7H6H..DH.J..EH.R..FH+X..GH.]..HH.f..IHdm..JH!...KH6...LHk...MH....NH....OHM...PH...bH....cH....dHx...eH@...fH..

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\app.asar

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	47549802
Entropy (8bit):	5.640545548304112
Encrypted:	false
SSDEEP:	393216:Q54tP6XHBB2ahT8ea7w5O5PIkre4P8ea7wD3rm5s:Q54tP6XHBB2ahvUF5d6AUg
MD5:	7473A5CC7205477CC0B9C9615D92709C
SHA1:	D3C5A4EFEE9E29C6BF3A1D0CA96E0848EE4E22DC
SHA-256:	52F4E65112F60C38319F3C6E403C68F1460939F5A3DDED4602E58D486005954D
SHA-512:	158EF480BAFDF32ACC53ACE630EE05E5611F69952DCF57CE0C8E3C5DD8F147AF14B6EAE1B256C899A3FB706DC685D7C0C050FA2B8E5C14C48AF2DDF2395C9EF2
Malicious:	false
Preview:	....P...L...H...{"files":{"icon.ico":{"size":8907,"offset":"0"},"index.js":{"size":819151,"offset":"8907"},"package.json":{"size":499,"offset":"828058"},"node_modules":{"files":{"inherits":{"files":{"LICENSE":{"size":749,"offset":"39073867"},"inherits.js":{"size":250,"offset":"39074616"},"inherits_browser.js":{"size":753,"offset":"39074866"},"package.json":{"size":394,"offset":"39075619"}}},"safe-buffer":{"files":{"LICENSE":{"size":1081,"offset":"41331863"},"index.js":{"size":1529,"offset":"41332944"},"package.json":{"size":500,"offset":"41334473"}}},"ansi-regex":{"files":{"index.js":{"size":135,"offset":"834327"},"license":{"size":1119,"offset":"834462"},"package.json":{"size":641,"offset":"835581"}}},"aproba":{"files":{"LICENSE":{"size":752,"offset":"836222"},"index.js":{"size":3966,"offset":"836974"},"package.json":{"size":534,"offset":"840940"}}},"are-we-there-yet":{"files":{"CHANGES.md":{"size":1324,"offset":"841474"},"LICENSE":{"size":733,"offset":"842798"},"index.js":{"size":163

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\resources\elevate.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.442687067441468
Encrypted:	false
SSDEEP:	3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
MD5:	792B92C8AD13C46F27C7CED0810694DF
SHA1:	D8D449B92DE20A57DF722DF46435BA4553ECC802
SHA-256:	9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
SHA-512:	6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\snapshot_blob.bin

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	351072
Entropy (8bit):	3.3309000287387587
Encrypted:	false
SSDEEP:	3072:P3JCPnnniIvFnfj2YPvS1Ox66vjitjLxyH/QIPc:fJCPniIvFQ1OutXo4Ic
MD5:	DDFCCC67869D10FEFB380705AC5F64F7
SHA1:	78C07165B74661483BC89F4C6D613405C6061B50
SHA-256:	E937FD647AA4FDEFEBB3B173E33934AB3C6BCBC3E6FA96E329E6D8FDED8EF943
SHA-512:	FCBC154E566988F999178161353B250E4FF74132B3993EE69F00D9A9D686B660235D55C8C6B90CE134529CE13AF964CFDA02B6132061DB8CD7AD8DB94EA527DF
Malicious:	false
Preview:	........U\..9.8.177.13-electron.0............................................B......x...J....B..a........a........a........at.......a........a.......... .]....`H...D..W.....W.....W...D. ..=.`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ....`....D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ..5.`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D.(Jb....!.....@..F^.....U`....`.....(Jb....B.....@..F^...`.....D...IDa........D`....D`....D`.......`.....D]....a............D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L`.....HD...%.D...L...........................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	460800
Entropy (8bit):	6.292346615983914
Encrypted:	false
SSDEEP:	6144:VFzcMPKWOp0q29LDwK3p3KHvDstVpphcSGbwSi6YH0hl:D2WOOqiLDrthhcSGEc
MD5:	A8BBAE490441D4F8B6A6F20C75F8C204
SHA1:	B05CB3E7E814E67378D9B0EEA4C6F5BE114B96A1
SHA-256:	6555C94228EAC6D6366FB43FA97057BB3AAA356F4C345F2BC61231C944CEEBE7
SHA-512:	8FB5C853D3881444706A9BF00F836CBBA79DC864A5AC6B7A0C7FFCEC42126102A41057A9B459F6334D96605BAE6085DE09722F27278B76FE04CAF7593829F099
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." ......................................................................`A........................................p........#..P....p..........h=..............p........................... ...(....4..0............'..(............................text............................... ..`.rdata...... ......................@..@.data....M....... ..................@....pdata..h=.......>..................@..@.00cfg..(....@......................@..@.tls.........P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3184128
Entropy (8bit):	6.419970116285636
Encrypted:	false
SSDEEP:	49152:m0mOy4fytPTlZQPF/IBCfG/owBx8iqQyehF3Hn0gPD2vzFW/GyCbZpjGKiqZ/nYC:mgfyjyeelZ/YNg/Yr
MD5:	165F756179DC4633BA4089D6FE542E48
SHA1:	7569E265C8CCC5A5A5716ED263F4BC5C0E431946
SHA-256:	D190EB4730A4C598B153910E4EF0B5AFC7307CAC92E06BB96029D7FAAC6C1046
SHA-512:	DDA3432D7F612D9CE2993F295388EFFC63398E68CCB1898242E137F4269526581AC30B6D2B80FE6866941CFC0F6977CDDA95D9D69028609BDDFB8563297DCF2E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." .....<+..V.......P'.......................................5...........`A........................................@.... ..5...d.....5.......4...............5.\1...f.......................e..(....d+.0...........`................................text....:+......<+................. ..`.rdata..T....P+......@+.............@..@.data........p/.. ...Z/.............@....pdata........4......z/.............@..@.00cfg..(....p5......Z0.............@..@.tls....).....5......\0.............@..._RDATA........5......^0.............@..@.rsrc.........5......`0.............@..@.reloc..\1....5..2...d0.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	671784
Entropy (8bit):	4.768886110016509
Encrypted:	false
SSDEEP:	6144:Q7EIYb04YEZ+KnirIhjTR2BrLcR0TQhp0M+qPK0Nq8d2CKySv4x7C/PbFcz:Hx0KcStL+MnPpqcHSv4+PbGz
MD5:	38923110390A201FDF5EC4CB7D5C0BBC
SHA1:	9194F10CC8B0018AF007959059A4ED3BF15F3168
SHA-256:	D761262B5D774E62CAB86EEF34F9D2F58C23F36E4D7A9FD49C50DCB573F4A274
SHA-512:	2DC6D70E663C32D3EFC4F297022721D0F24F014FCCF2CA4FFB6FF3A7355EC2FDCE458BD45989B453501BFD8380D89B558BC1F35FF578DC15DC4B1468CB1A5AC7
Malicious:	false
Preview:	..........A.9.8.177.13-electron.0............................................K......o..0.......J....J..a........a........aR.......at.......a........a.......... .]....`H...D..W.....W.....W...D. ..=.`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ....`....D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ....`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D. ..5.`H...D..W.....W.....W...D. ..`H...D..W.....W.....W...D.(Jb....!.....@..F^.....U`....`.....(Jb....B.....@..F^...`.....D...IDa........D`....D`....D`.......`.....D]....a............D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L`.....HD...%.D...L...................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4583936
Entropy (8bit):	6.266448694713762
Encrypted:	false
SSDEEP:	49152:Sx2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:f2DtJ+wixdag
MD5:	7CB8ABAE50AF645AE4C3EBC213E035F5
SHA1:	2DF17AF9FBD834E1F67EE8C547E2283DC71CFFDF
SHA-256:	43E63B8E9FB18E6D21AB04B8BE293D467C039B267FE92B8B43E061486B9530BE
SHA-512:	4AA7FD99D1CD66245B3B1E16F74F834631CF64DACDB2DB4780C51A569748A92A6C1BEE40A12B140BF17B9C778E6A42713F2BBAC6D2E1C6F702886B212BD75673
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." .....P9.........PF2......................................PG...........`A.........................................OC.....iC.P.....F......pE..,............F.8h..t"C...................... C.(....t9.0............nC.h............................text....O9......P9................. ..`.rdata.......`9......T9.............@..@.data...."...@D..&...D.............@....pdata...,...pE..,...PD.............@..@.00cfg..(.....F......\|E.............@..@.tls....A.....F......~E.............@..._RDATA........F.......E.............@..@.rsrc.........F.......E.............@..@.reloc..8h....F..j....E.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	839168
Entropy (8bit):	6.537431635281859
Encrypted:	false
SSDEEP:	12288:3kyJJLfcn5To6PuXtLvEdGnZSss43uobSoD:cnhoR5Ed8S2uuD
MD5:	492FB935708585790729E726C34EF302
SHA1:	04385DE9005613E63616026DD7466E72D04631BC
SHA-256:	89AD755092852350ED9F5D9C9544F07B9605B874FF4726F4F35CBAA941938E5F
SHA-512:	FE8DBAD3F442EA858F240795E442E79820C22D5AE06E65E4BD39BF69CCC681F3E9577A87E0FBE45A573F22C6E9026D0060C82D3B7B471B5476E6D74AF0994AB3
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....3`b.........." ................pS.......................................P............`A...........................................s...K...P....0...........e...........@.......\|.......................{..(.......0...........x................................text...v........................... ..`.rdata..4n.......p..................@..@.data....K...@... ...0..............@....pdata...e.......f...P..............@..@.00cfg..(...........................@..@.tls................................@..._RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7e239a60-0e4c-4af8-a9fc-84fafa2cf063.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2662400
Entropy (8bit):	5.92535836552942
Encrypted:	false
SSDEEP:	49152:wUXIZZPwjt19xOxja5naXO5Xo0o+liQlnaSJseH+:cZCtDxOZa5v9wAf
MD5:	08BAB1E149D66C6DE2E3D698EEAD0E88
SHA1:	9C1278267E65A6B3AA18E8732518A5C0CC046764
SHA-256:	E092B7F0DD74258D184C58419700ADB30BD1040C28134C26A8B2633901AD26E6
SHA-512:	63A08F55195EFBF217553ED614DB596B93C64B2D216455D3BD3E5C78835874D78B61C70E8447747C77CB3C4692A17A1F8FD7CC8F1F8FD3B1217B88E736A7F78E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k...............a.......a.......a..$....}.......}......E}.......}.......a..........d...E}......E}......E}i.....E}......Rich............................PE..d.....jb.........." .....4!..................................................0)...........`.........................................`l&.....xu(.(.....(.<.... '../............(.@.....$.8.............................$.8............p(.x.....(.@....................text....2!......4!................. ..`.rdata.......P!......8!.............@..@.data...y....p&..~...V&.............@....pdata...O... '..P....&.............@..@.idata.......p(......$(.............@..@.didat..d!....(.."...<(.............@....00cfg..c.....(......^(.............@..@_RDATA..".....(......`(.............@..@.rsrc...<.....(......d(.............@..@.reloc...5....(..6...j(.............@..B........................................................

C:\Users\user\AppData\Local\Temp\a504bfce-c13f-4050-bbc4-80150c37d231.tmp.node

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	598528
Entropy (8bit):	5.6778929056410234
Encrypted:	false
SSDEEP:	6144:hJz44SJJQhRB0qwQ+jays7g7waqzId5hzFDFJ:hJM4WmhRzAut7VNId
MD5:	0BA1901C565BEA6B6A261C2FE4F710F8
SHA1:	B2FA9B2C478D39B0B3DA7B43FFF24203BC55F32A
SHA-256:	DEC2A70E7EBDB050DD7C5B3022E61126CC7486DED1DAB94AFFC9A3E7FDC7869D
SHA-512:	AA33CDC08B57A0F353066598F591E117C267C8A03EB38E9CB70580CA818D59E554C217FE9457AFCCD1A01E681B4B6AB14AA7E4BA3C252E0EDBBF515B337AE00A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........].T.3CT.3CT.3C@.7B_.3C@.0BQ.3C@.6B.3C...CU.3C..7BZ.3C..0B].3C..6Bp.3C@.2BQ.3CT.2C/.3C..6BV.3C..3BU.3C...CU.3C..1BU.3CRichT.3C........................PE..d.....jb.........." .........:............................................................`.............................................n... D..<.......<.......<K......................8...........................P...8............@.. ....`..@....................text...%........................... ..`.rdata...q... ...r..................@..@.data....3...........z..............@....pdata...S.......T..................@..@.idata.......@......................@..@.didat.......`......................@....00cfg..c....p......................@..@_RDATA.."...........................@..@.rsrc...<...........................@..@.reloc..*...........................@..B........................................................

C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.729923587623207
Encrypted:	false
SSDEEP:	3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5:	C6A6E03F77C313B267498515488C5740
SHA1:	3D49FC2784B9450962ED6B82B46E9C3C957D7C15
SHA-256:	B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
SHA-512:	9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!........b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....)......................... ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\app-64.7z

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	62534760
Entropy (8bit):	7.999994996815069
Encrypted:	true
SSDEEP:	1572864:k47pmXsV8hGNGf+dB8CDtN8XJ16V1dp2w0ufNADMsO8AtJ:rs8VKGo+b8CDtN8+L2w0uFP3
MD5:	2D5BC330AE86534C10ED0590467C56CC
SHA1:	AFDEFB81382B1E87DA374615382709E0810317AB
SHA-256:	63FE25D73EDE0420DE677D7374AD5D77C0AA4DE9A841DD9264E843863BBC8517
SHA-512:	36D5EAAEB977C6399AD7F34013628E6171FB72DFCE262673E7380AE4D4EFDF3D02B32BDBD232A74F59134A7D98A6B6DA1EE28E87E924D9CDD26407BC0760B858
Malicious:	false
Preview:	7z..'.....#.#4......%........(s...b..]...6.........y......{c.......+O...{r.b...A[..Kh....W-.^.[.\V@.P.U.j1..;.+.,..T..8.6..n.Z...q.....h..H;.<.S..u.7...Fr....E..`.....4.U;!..\|...R..H...e...l.2....3..Q..1..B...r.S.I{J..q.....S.....;u.,.32...~R.bU..,R.F69....BA...r..r.+@...8&..[.....Y..$..#q.g.........xG..e!.T;...! w..G........0..\.$~..^..d.....v.....)'.e .......B....9....yQ.4...htX.5.....n9.x..k/....?,.....qu7.a4...n.d..{..oS.(...sn..M.../...V....FE,................tG.B.<..5.h"....{.\R.ox.@R.37V..d..X......2.8......L0]8pA^C._....^......."N>.tu.a.]k..\.../../...$..de......?`...by.x.....^...>b.....1...z.Wl.58vN&.e..@.l....NI...qGP;<...'........~.. Hp.........n....v&.....-. C........E.y...........nr.......'.[HP....yD../...?...Jr.......\|..78..5. ...n.m.......Z.r3.-.s...qE.:j.m..N.......oEG5.2.p......]...S.1.....-us...U#.!.6.>.8...R..^.>...-...i..Y.~..v...W....d..r...o.....im.co.A..!T.~.A.V.....w....a......R.&.=M.3.cM..c.bI...w..+R.7A$..uy...p...

C:\Users\user\AppData\Local\Temp\nsp4E90.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.584811966667578
Encrypted:	false
SSDEEP:	6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5:	80E44CE4895304C6A3A831310FBF8CD0
SHA1:	36BD49AE21C460BE5753A904B4501F1ABCA53508
SHA-256:	B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
SHA-512:	C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Game Installer\96bfb30c-9a07-411d-a893-06e8ccdd2d29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	389
Entropy (8bit):	5.638212040290515
Encrypted:	false
SSDEEP:	12:YKWSg99rrt+/5tamQPdspmkvgnsvb2FeFj1:YKWfrrtSAmYAmkvgsvFR
MD5:	0C06115B2D6C99E0068E01C1D90CF342
SHA1:	64E3FD2CB46F0109EFD9C4B0F0AE44714914044E
SHA-256:	A783A82388E9A6E45F1B7DD0F74DC2A1D282FE5DA4EC0C66D94A984A23A60D8E
SHA-512:	643A2D7A4A6C58E8550A85D8325503D39794BBD042289D12782C58BD4AD9BEEBFC8E0332ECABD28B7CD40E54C877780E8A20E6E8D14D708B27242F71E1F4DFB7
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADPqi6FSzDJSrBTfqYFdYz8AAAAAAIAAAAAABBmAAAAAQAAIAAAAEY0zIdyjI3oGVRKl1Ta61u7UaI/TovpYAiw246WKrgnAAAAAA6AAAAAAgAAIAAAAEH7c58vpMcitmg3Lktg/YQ+qJlJ2fQ+1r+QmdGPsn1xMAAAAPuKz9uh1DFJxj0QFjk/kPtkiJPaq7LA6w2sU/62g3/NXZBaA/neb6cp3MyUD6OptEAAAAAJ4/RFQjzb+D434W5GoH1oMXhwvNNcYIlduTKu7vDSxoDryuwtpNYxTgzI86uiylOTeeH4E5pZvoOjrrXVgLH9"}}

C:\Users\user\AppData\Roaming\Game Installer\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.638212040290515
Encrypted:	false
SSDEEP:	12:YKWSg99rrt+/5tamQPdspmkvgnsvb2FeFj1:YKWfrrtSAmYAmkvgsvFR
MD5:	0C06115B2D6C99E0068E01C1D90CF342
SHA1:	64E3FD2CB46F0109EFD9C4B0F0AE44714914044E
SHA-256:	A783A82388E9A6E45F1B7DD0F74DC2A1D282FE5DA4EC0C66D94A984A23A60D8E
SHA-512:	643A2D7A4A6C58E8550A85D8325503D39794BBD042289D12782C58BD4AD9BEEBFC8E0332ECABD28B7CD40E54C877780E8A20E6E8D14D708B27242F71E1F4DFB7
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADPqi6FSzDJSrBTfqYFdYz8AAAAAAIAAAAAABBmAAAAAQAAIAAAAEY0zIdyjI3oGVRKl1Ta61u7UaI/TovpYAiw246WKrgnAAAAAA6AAAAAAgAAIAAAAEH7c58vpMcitmg3Lktg/YQ+qJlJ2fQ+1r+QmdGPsn1xMAAAAPuKz9uh1DFJxj0QFjk/kPtkiJPaq7LA6w2sU/62g3/NXZBaA/neb6cp3MyUD6OptEAAAAAJ4/RFQjzb+D434W5GoH1oMXhwvNNcYIlduTKu7vDSxoDryuwtpNYxTgzI86uiylOTeeH4E5pZvoOjrrXVgLH9"}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9999868273341965
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	62879521
MD5:	a47b343c963dad673377364848549897
SHA1:	1faf9a21bf8dde2762ece37a1716f04664665b37
SHA256:	3d197e9b80ff2d1fb40dbbd2bacf0988a8e877986732dc39eadffaf6749df4dd
SHA512:	b0a41a46195e72382b7405b19f6296a36a04eed10804f10c29713b63975689052f2e2152cf54f2c3cec5a0d9c10f9dfcd1590a435c995aa64dbd401635fe7912
SSDEEP:	1572864:/47pmXsV8hGNGf+dB8CDtN8XJ16V1dp2w0ufNADMsO8Atf7:Ms8VKGo+b8CDtN8+L2w0uFPp7
TLSH:	08D7337477A08A37C0A7EB34617E4903528A29827EFA70C63B6CD6CDAD97C433B45974
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

File Icon


Icon Hash:	42b0b0b2cce8e030

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0047AEECh], eax
je 00007F192CF1A2C3h
push ebx
call 00007F192CF1D575h
cmp eax, ebx
je 00007F192CF1A2B9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F192CF1D4EFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F192CF1A29Ch
push 0000000Ah
call 00007F192CF1D548h
push 00000008h
call 00007F192CF1D541h
push 00000006h
mov dword ptr [0047AEE4h], eax
call 00007F192CF1D535h
cmp eax, ebx
je 00007F192CF1A2C1h
push 0000001Eh
call eax
test eax, eax
je 00007F192CF1A2B9h
or byte ptr [0047AEEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0047AFB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00440208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10b000	0x2c60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x90000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x10b000	0x2c60	0x2e00	False	0.825577445652174	data	7.281830806447493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x10b1d8	0x22b5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_DIALOG	0x10d490	0x100	data	English	United States
RT_DIALOG	0x10d590	0xf8	data	English	United States
RT_DIALOG	0x10d688	0x60	data	English	United States
RT_GROUP_ICON	0x10d6e8	0x14	data	English	United States
RT_VERSION	0x10d700	0x21c	data	English	United States
RT_MANIFEST	0x10d920	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2022 06:00:35.642591953 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.642666101 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.643064976 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.643147945 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.643616915 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.643620014 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.644143105 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.644202948 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.644800901 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.644866943 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.676429987 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.677054882 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.680108070 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.680310011 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.684287071 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.684760094 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.684782982 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.686645985 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.686873913 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.719832897 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.760473967 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.760538101 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.760699034 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.760709047 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.760817051 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.760909081 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.761049986 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.761055946 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.807630062 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.807782888 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.808406115 CEST	49805	443	192.168.11.20	149.112.112.112
Sep 1, 2022 06:00:35.808420897 CEST	443	49805	149.112.112.112	192.168.11.20
Sep 1, 2022 06:00:35.813591957 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.813606977 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.814238071 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.814377069 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.814405918 CEST	443	49804	104.18.42.171	192.168.11.20
Sep 1, 2022 06:00:35.814533949 CEST	49804	443	192.168.11.20	104.18.42.171
Sep 1, 2022 06:00:35.814546108 CEST	49804	443	192.168.11.20	104.18.42.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2022 06:00:04.848031998 CEST	64221	53	192.168.11.20	1.1.1.1
Sep 1, 2022 06:00:05.004755020 CEST	53	64221	1.1.1.1	192.168.11.20
Sep 1, 2022 06:00:35.627748966 CEST	65066	53	192.168.11.20	1.1.1.1
Sep 1, 2022 06:00:35.628541946 CEST	57074	53	192.168.11.20	1.1.1.1
Sep 1, 2022 06:00:35.636617899 CEST	53	65066	1.1.1.1	192.168.11.20
Sep 1, 2022 06:00:35.637376070 CEST	53	57074	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 1, 2022 06:00:04.848031998 CEST	192.168.11.20	1.1.1.1	0x7472	Standard query (0)	superfuniestindianparty.rip	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.627748966 CEST	192.168.11.20	1.1.1.1	0xed88	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.628541946 CEST	192.168.11.20	1.1.1.1	0xc99f	Standard query (0)	dns.quad9.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 1, 2022 06:00:05.004755020 CEST	1.1.1.1	192.168.11.20	0x7472	Name error (3)	superfuniestindianparty.rip	none	none	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.636617899 CEST	1.1.1.1	192.168.11.20	0xed88	No error (0)	chrome.cloudflare-dns.com		104.18.42.171	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.636617899 CEST	1.1.1.1	192.168.11.20	0xed88	No error (0)	chrome.cloudflare-dns.com		172.64.145.85	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.637376070 CEST	1.1.1.1	192.168.11.20	0xc99f	No error (0)	dns.quad9.net		149.112.112.112	A (IP address)	IN (0x0001)
Sep 1, 2022 06:00:35.637376070 CEST	1.1.1.1	192.168.11.20	0xc99f	No error (0)	dns.quad9.net		9.9.9.9	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

dns.quad9.net

chrome.cloudflare-dns.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49805	149.112.112.112	443	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

Timestamp	kBytes transferred	Direction	Data
2022-09-01 04:00:35 UTC	0	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2022-09-01 04:00:35 UTC	0	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2022-09-01 04:00:35 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 01 Sep 2022 04:00:35 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=167
2022-09-01 04:00:35 UTC	1	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a7 00 04 ac d9 a8 43 00 00 29 04 d0 00 00 00 00 00 00 Data Ascii: wwwgstaticcomC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49804	104.18.42.171	443	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

Timestamp	Direction	Data
2022-09-01 04:00:35 UTC	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2022-09-01 04:00:35 UTC	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2022-09-01 04:00:35 UTC	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 01 Sep 2022 04:00:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 743b198f8f399a09-FRA
2022-09-01 04:00:35 UTC	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 87 00 04 8e fa b8 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Target ID:	1
Start time:	05:59:00
Start date:	01/09/2022
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	62879521 bytes
MD5 hash:	A47B343C963DAD673377364848549897
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	9
Start time:	05:59:35
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Imagebase:	0x7ff7eeca0000
File size:	146324992 bytes
MD5 hash:	ACA468C6E2E01F3698C5E3C79394FB57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	13
Start time:	06:00:05
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff7eeca0000
File size:	146324992 bytes
MD5 hash:	ACA468C6E2E01F3698C5E3C79394FB57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	14
Start time:	06:00:05
Start date:	01/09/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Imagebase:	0x7ff604770000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	15
Start time:	06:00:05
Start date:	01/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff665960000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	06:00:05
Start date:	01/09/2022
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6f8bc0000
File size:	106496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	06:00:18
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --mojo-platform-channel-handle=2080 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Imagebase:	0x7ff7eeca0000
File size:	146324992 bytes
MD5 hash:	ACA468C6E2E01F3698C5E3C79394FB57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	06:02:05
Start date:	01/09/2022
Path:	C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --user-data-dir="C:\Users\user\AppData\Roaming\Game Installer" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 --field-trial-handle=1624,11055175116320894089,15330204900087283469,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff7eeca0000
File size:	146324992 bytes
MD5 hash:	ACA468C6E2E01F3698C5E3C79394FB57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.idx

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.lock

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.val

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\58b32cb0d51bbf24\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies.bby

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bby

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bby

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cookies.bby

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.bby

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.bby

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\System.exe

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\28YS8twMdrJ2BWUL41WSjEgnZVo\icudtl.dat

Windows Analysis Report
Setup.exe